https://community.splunk.com/t5/Splunk-Enterprise/What-is-the-role-of-INDEXED-VALUE-in-fields-conf/m-p/543330#M5246 <P>Hi</P><P>Maybe these answers, blogs and docs helps to understand this?</P><UL><LI><A href="https://www.splunk.com/en_us/blog/tips-and-tricks/cannot-search-based-on-an-extracted-field.html" target="_blank">https://www.splunk.com/en_us/blog/tips-and-tricks/cannot-search-based-on-an-extracted-field.html</A></LI><LI><A href="https://docs.splunk.com/Documentation/Splunk/8.1.2/Knowledge/Exampleconfigurationswithprops.conf" target="_blank">https://docs.splunk.com/Documentation/Splunk/8.1.2/Knowledge/Exampleconfigurationswithprops.conf</A></LI><LI><A href="https://community.splunk.com/t5/Splunk-Search/Why-am-I-getting-inconsistent-event-counts-when-using-wildcard/td-p/226350" target="_blank">https://community.splunk.com/t5/Splunk-Search/Why-am-I-getting-inconsistent-event-counts-when-using-wildcard/td-p/226350</A></LI></UL><P>r. Ismo</P> Thu, 11 Mar 2021 08:25:38 GMT isoutamo 2021-03-11T08:25:38Z https://community.splunk.com/t5/Splunk-Enterprise/What-is-the-role-of-INDEXED-VALUE-in-fields-conf/m-p/543321#M5245 <P class="lia-align-left">Hi,&nbsp;</P><P class="lia-align-left">There is the description for INDEXED_VALUE in fields.conf</P><PRE>INDEXED_VALUE = [true|false|&lt;sed-cmd&gt;|&lt;simple-substitution-string&gt;] * Set this to true if the value is in the raw text of the event. * Set this to false if the value is not in the raw text of the event. * Setting this to true expands any search for key=value into a search of value AND key=value (since value is indexed).<BR /><BR /></PRE><PRE>* NOTE: You only need to set indexed_value if indexed = false.</PRE><P>INDEXED_VALUE is used when indexed = false according to the description. Then, when is the option&nbsp;INDEXED_VALUE used? Which circumstances require this option?</P><P>Is there a case where only value is indexed and key(field) is not indexed?</P><P>The description makes me confused.. Hope anyone help me out.</P><P>Thanks a lot.</P> Thu, 11 Mar 2021 07:04:31 GMT https://community.splunk.com/t5/Splunk-Enterprise/What-is-the-role-of-INDEXED-VALUE-in-fields-conf/m-p/543321#M5245 brandy81 2021-03-11T07:04:31Z https://community.splunk.com/t5/Splunk-Enterprise/What-is-the-role-of-INDEXED-VALUE-in-fields-conf/m-p/543330#M5246 <P>Hi</P><P>Maybe these answers, blogs and docs helps to understand this?</P><UL><LI><A href="https://www.splunk.com/en_us/blog/tips-and-tricks/cannot-search-based-on-an-extracted-field.html" target="_blank">https://www.splunk.com/en_us/blog/tips-and-tricks/cannot-search-based-on-an-extracted-field.html</A></LI><LI><A href="https://docs.splunk.com/Documentation/Splunk/8.1.2/Knowledge/Exampleconfigurationswithprops.conf" target="_blank">https://docs.splunk.com/Documentation/Splunk/8.1.2/Knowledge/Exampleconfigurationswithprops.conf</A></LI><LI><A href="https://community.splunk.com/t5/Splunk-Search/Why-am-I-getting-inconsistent-event-counts-when-using-wildcard/td-p/226350" target="_blank">https://community.splunk.com/t5/Splunk-Search/Why-am-I-getting-inconsistent-event-counts-when-using-wildcard/td-p/226350</A></LI></UL><P>r. Ismo</P> Thu, 11 Mar 2021 08:25:38 GMT https://community.splunk.com/t5/Splunk-Enterprise/What-is-the-role-of-INDEXED-VALUE-in-fields-conf/m-p/543330#M5246 isoutamo 2021-03-11T08:25:38Z