https://community.splunk.com/t5/Getting-Data-In/Getting-extracted-host-extracted-source-extracted-sourcetype/m-p/668580#M112054 <P>Looks like below<BR /><A href="https://community.splunk.com/t5/Getting-Data-In/How-to-get-the-host-value-from-INDEXED-EXTRACTIONS-json/m-p/577392" target="_blank">https://community.splunk.com/t5/Getting-Data-In/How-to-get-the-host-value-from-INDEXED-EXTRACTIONS-json/m-p/577392</A></P> Tue, 14 Nov 2023 15:22:44 GMT bharathkumarnec 2023-11-14T15:22:44Z https://community.splunk.com/t5/Getting-Data-In/Getting-extracted-host-extracted-source-extracted-sourcetype/m-p/667352#M111927 <P>I am getting getting extracted_host, extracted_source, extracted_sourcetype fields in interesting fields along with host, source, sourcetype in selected fields while ingesting logs using HEC input in Splunk Cloud.</P><P><BR />Can someone help why I am gettin&nbsp;extracted_host, extracted_source, extracted_sourcetype fields in the logs even if they are not define in the source end.</P><P>&nbsp;</P> Fri, 03 Nov 2023 19:03:40 GMT https://community.splunk.com/t5/Getting-Data-In/Getting-extracted-host-extracted-source-extracted-sourcetype/m-p/667352#M111927 nilbak88 2023-11-03T19:03:40Z https://community.splunk.com/t5/Getting-Data-In/Getting-extracted-host-extracted-source-extracted-sourcetype/m-p/668580#M112054 <P>Looks like below<BR /><A href="https://community.splunk.com/t5/Getting-Data-In/How-to-get-the-host-value-from-INDEXED-EXTRACTIONS-json/m-p/577392" target="_blank">https://community.splunk.com/t5/Getting-Data-In/How-to-get-the-host-value-from-INDEXED-EXTRACTIONS-json/m-p/577392</A></P> Tue, 14 Nov 2023 15:22:44 GMT https://community.splunk.com/t5/Getting-Data-In/Getting-extracted-host-extracted-source-extracted-sourcetype/m-p/668580#M112054 bharathkumarnec 2023-11-14T15:22:44Z