I'm trying to index a file but I don't want Splunk to try to extract interesting fields. Or if it does, I want the field to be the entire contents of the file called 'contents'. Is this possible?
Fields are extracted on the search head which push out knowledge bundles to the indexers when you search
To test this, do a search in Fast Mode
and notice how it does not enable field discovery which means your fields are not available.. Then do a search in Smart or Verbose mode
and notice your fields are available
Fields are extracted on the search head which push out knowledge bundles to the indexers when you search
To test this, do a search in Fast Mode
and notice how it does not enable field discovery which means your fields are not available.. Then do a search in Smart or Verbose mode
and notice your fields are available
Maybe I'm understanding indexing wrong. Are these fields are not indexed when I switch to verbose mode?
You technically can extract fields at index time, but its not recommended to do so for performance issues. Fields are extracted at search time by the search head, hence why the fields are available depending on which search mode you use.
You only index the data once which is when it goes from your forwarder to the indexer. The data is available to be searched on the indexer, but fields will be available because they are defined on the SH which push knowledge bundles to the indexers when the indexers begin to search the data
Remember that indexers are responsible for indexing AND searching the data
It all makes sense now. Thanks for your help.