topic Does INDEXED_EXTRACTIONS imply index fields for all the fields? in Getting Data In

Does INDEXED_EXTRACTIONS imply index fields for all the fields?

spl_aficionado — Mon, 09 Feb 2026 14:57:11 GMT

I just set INDEXED_EXTRACTIONS = CSV for a large data ingestion sourcetype, and validating with tstats, and it seems that all the fields are indexed fields, is it true in general including for JSON? Is there any way around it of not making them indexed fields?

Re: Does INDEXED_EXTRACTIONS imply index fields for all the fields?

richgalloway — Mon, 09 Feb 2026 14:59:35 GMT

Yes, setting INDEXED_EXTRACTIONS=JSON will index all of the fields in each event. There is no way to prevent that, which is why many recommend against using INDEXED_EXTRACTIONS at all.

Re: Does INDEXED_EXTRACTIONS imply index fields for all the fields?

gcusello — Mon, 09 Feb 2026 15:07:22 GMT

Hi @spl_aficionado ,

using INDEXED_EXTRACTIONS=csv, you extract all the fields, but they aren't indexed time fields.

If you mead extracted fields, yes all fields are extracted, if you mean indexed fields, they aren't indexed fields.

Ciao.

Giuseppe