https://community.splunk.com/t5/Splunk-Search/Extraction-Precedence/m-p/129247#M184496 <P>No, indexing has to happen before searching. This can explain it in more detail:</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/latest/Data/WhatSplunkdoeswithyourdata">What Splunk Does With Your Data</A></P> Tue, 05 Nov 2013 16:39:14 GMT ShaneNewman 2013-11-05T16:39:14Z https://community.splunk.com/t5/Splunk-Search/Extraction-Precedence/m-p/129246#M184495 <P>If you have index time extractions configured will search time extractions override them?</P> Tue, 05 Nov 2013 16:26:56 GMT https://community.splunk.com/t5/Splunk-Search/Extraction-Precedence/m-p/129246#M184495 tprzelom 2013-11-05T16:26:56Z https://community.splunk.com/t5/Splunk-Search/Extraction-Precedence/m-p/129247#M184496 <P>No, indexing has to happen before searching. This can explain it in more detail:</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/latest/Data/WhatSplunkdoeswithyourdata">What Splunk Does With Your Data</A></P> Tue, 05 Nov 2013 16:39:14 GMT https://community.splunk.com/t5/Splunk-Search/Extraction-Precedence/m-p/129247#M184496 ShaneNewman 2013-11-05T16:39:14Z https://community.splunk.com/t5/Splunk-Search/Extraction-Precedence/m-p/129248#M184497 <P>Well, not entirely true - you can override the values of index-time extractions for the duration of a search (see below), but once an event is stored in an index, it cannot be altered <STRONG>on disk</STRONG> by search time operations.</P> <PRE><CODE>* | head 5 | eval host=host . "-monkey" | eval source=source . "-crane" | eval sourcetype=sourcetype . "-blah" | table host source sourcetype </CODE></PRE> <P>Edit: clarification<BR /> /K</P> Tue, 05 Nov 2013 20:41:55 GMT https://community.splunk.com/t5/Splunk-Search/Extraction-Precedence/m-p/129248#M184497 kristian_kolb 2013-11-05T20:41:55Z