topic How find index-time field extractions. in Getting Data In

How find index-time field extractions.

adamsmith47 — Tue, 17 Dec 2019 16:44:13 GMT

Hello all,

Our environment has some custom index-time field extractions we find to be very useful (yes, I know Splunk doesn't recommend this). Though due to the possible performance implications of this practice, I want to be 100% confident I know where all index-time fields exist in our indexes.

At first, I thought this would be easy, throw a |tstats command together... when it dawned on me I have no idea how to do this.

So, if anyone can think of how to get a list of indexes/sources/sourcetypes which contain non-standard index-time field extractions, that'd be a life-saver!

Thanks for any help.

Re: How find index-time field extractions.

martynoconnor — Tue, 17 Dec 2019 20:37:37 GMT

| tstats count where index=yourindex by yourindexedfield

If it works, you're in business, if not... sadly no.

You could also do a conventional search like

index=foo fieldname::value

If that works, it's an indexed field.

Re: How find index-time field extractions.

esix_splunk — Tue, 17 Dec 2019 21:06:02 GMT

Ill add to this that you need to make sure you have the correct configurations deployed on your SH for indexed fields for them to be properly recognized via *fields.conf ( https://docs.splunk.com/Documentation/Splunk/8.0.0/Data/Configureindex-timefieldextraction)