title: Unable to extract JSON fields in Splunk
body: <p>I'm trying to extract JSON fields from syslog inputs.</p>
  
  <p>In <code>./etc/system/default/props.conf</code> I've added the following lines:</p>
  
  <pre><code>[mylogtype]
  SEDCMD-StripHeader = s/^[^{]+//
  INDEXED_EXTRACTIONS = json
  KV_MODE = none
  pulldown_type = true
  </code></pre>
  
  <p>The <code>SEDCMD</code> works; the syslogs headers are removed.</p>
  
  <p><a href="https://i.stack.imgur.com/Y9fl0.jpg" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/Y9fl0.jpg" alt="enter image description here"></a></p>
  
  <p>But the JSON fields are not parsed. </p>
  
  <p>Any ideas?</p>