Splunk Search

Extracting Fields in search time

misteryuku
Communicator

What is the purpose of creating a search time extracted field while i still can use search commands to retrieve he fields during the search?

0 Karma

Ayn
Legend

?

Fields are generally extracted at search time. Without these extractions there would be no fields for you to retrieve. Also I don't understand what search commands you mean that you're using for retrieving fields, please clarify.

And for the umpteenth time, read the docs.

Ayn
Legend

Like I said, without search-time field extractions there would be no fields for you to retrieve. Splunk extracts some fields automatically - if it finds text like "fieldX=valueX" in the raw event, the field "fieldX" will be created with the value "valueX". This is also a search-time field extraction that is done automatically for you. If you're already getting all the fields you need through this technique, it is true that you don't need to define any more field extractions yourself.

0 Karma

misteryuku
Communicator

for example , when i search using this command : search sourcetype=sampledata | fields* then i can retrieve the results with the fields and the fields that i created before sending to the receivers REST endpoint.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...