topic Re: field extraction in Getting Data In

field extraction

VijaySrrie — Wed, 28 Oct 2020 05:51:31 GMT

Hi,

How to find whether a field is extracted at index time (or) search time?

Re: field extraction

isoutamo — Wed, 28 Oct 2020 07:33:47 GMT

You could use walklex command to get list of index time extractions. Rest of fields are search time extracted.

| walklex index=main type=field | dedup field | table field

https://docs.splunk.com/Documentation/Splunk/8.1.0/SearchReference/Walklex

r. Ismo

Re: field extraction

VijaySrrie — Wed, 28 Oct 2020 08:58:58 GMT

I am getting below error in Splunk PROD

Unknown search command 'walklex'.

Re: field extraction

isoutamo — Wed, 28 Oct 2020 09:29:29 GMT

HI
this command has come on version 7.3.0. If you have older version then it's time to update anyhow as 7.2 is quite soon out of support.
Before that you could search from answers what are other ways to get this information.
r. Ismo