I am confused as well, but apparently this is resolved. The issue I was seeing with JSON events originally described also was with some other, non-JSON events. I opened a ticket with support. They, like you, created one of the extractions without issue on the AdHoc Splunk Cloud SH. I was able to create another on the AdHoc SH, but to line up with the data models I had been trying to use the ES Search Head. After that, the previous extractions I had created on the ES Search Head seemed to start working. Not sure if something changed, or if I had just been impatient previously and not letting the extraction enough time to apply. So things are resolved now, and I don't understand why. But things are working as intended.
... View more