just set the KV_MODE=JSON on the SH (indexer) and remove the I_E from the forwarder.     ... View more

 KV_MODE=JSON is the search time setting it should be on the SH, you can create a new one from the UI to test.  ... View more

You can go to the UI > Settings > Sourcetypes > armor_json_02 > update the KV_MODE=JSON after disabling the I_E ... View more

I don't see anything local other than the below: Not sure if this is your sourcetype. /opt/splunkforwarder/etc/apps/armor/local/props.conf [armor_json_02] /opt/splunkforwarder/etc/apps/armor/local/props.conf INDEXED_EXTRACTIONS = json /opt/splunkforwarder/etc/apps/armor/local/props.conf description = JavaScript Object Notation format. For more information, visit http://json.org/ We need more on what's applying to the enterprise as well. And It's hard to convey the troubleshooting steps here.  1.) Try to run the btool command specific to your sourcetype such as  splunk btool props list "your_sourcetype" --debug      splunk btool props list --debug | grep -v /system/default  2.) As @somesoni2 mentioned make sure KV_MODE=JSON or INDEXED_EXTRACTIONS = json  only one of them is set . My personal recommendation is to use KV_MODE=JSON instead of I_E=JSON I hope running this search might help you with the settings applied to the parsing instance. | rest splunk_server=local /services/configs/conf-props/YOUR_SOURCETYPE | transpose | search column=eai:acl.app  Hope this helps. If you need more assistance, encourage you to open an ODS request. an https://www.splunk.com/en_us/pdfs/professional-services/splunk-ondemand-services-portal.pdf ... View more

please paste your btool output for props on the UF & enterprise, here to validate.  splunk btool props list --debug   ... View more

remove the INDEXED_EXTRACTIONS = json on your props.  ... View more

Is the Volume specified tstatsHomePath" writable? Do you see this after a restart? ... View more

Try something like this from the metrics log. index=_internal source=*metrics.log* host=idx* series=yourindexname | stats latest(_time) as last_data_time by series | eval duration_seconds = now() - last_data_time | eval duration_human = strftime(duration_seconds, "%d days %H:%M:%S") | where duration_seconds > <your_duration_in_seconds> ... View more

Create a file alert_actions.conf on the system/local of the SH, and have the below config, then restart. cat /opt/splunk/etc/system/local/alert_actions.conf [email] from = splunksupport@company.com Note: - This was an old question, providing a direct answer, than getting into docs and investigating. ... View more