https://community.splunk.com/t5/Getting-Data-In/If-I-have-no-transforms-conf-or-props-conf-when-are-fieldnames/m-p/381074#M68751 <P>Fields are extracted at search time unless Splunk is explicitly told to do so at index time. Since you didn't say to, nothing is extracted at index time.</P> Fri, 17 May 2019 21:22:13 GMT richgalloway 2019-05-17T21:22:13Z https://community.splunk.com/t5/Getting-Data-In/If-I-have-no-transforms-conf-or-props-conf-when-are-fieldnames/m-p/381073#M68750 <P>So if I had incoming data and it goes to an indexer, would the fieldnames/fieldvalues be extracted at that point as they are being indexed or are fieldnames/fieldvalues extracted during search time?</P> <P>transforms.conf/props.conf would make it so that the fieldnames/fieldvalues are extracted during indexing, correct?</P> Fri, 17 May 2019 20:21:31 GMT https://community.splunk.com/t5/Getting-Data-In/If-I-have-no-transforms-conf-or-props-conf-when-are-fieldnames/m-p/381073#M68750 vzedbny 2019-05-17T20:21:31Z https://community.splunk.com/t5/Getting-Data-In/If-I-have-no-transforms-conf-or-props-conf-when-are-fieldnames/m-p/381074#M68751 <P>Fields are extracted at search time unless Splunk is explicitly told to do so at index time. Since you didn't say to, nothing is extracted at index time.</P> Fri, 17 May 2019 21:22:13 GMT https://community.splunk.com/t5/Getting-Data-In/If-I-have-no-transforms-conf-or-props-conf-when-are-fieldnames/m-p/381074#M68751 richgalloway 2019-05-17T21:22:13Z