https://community.splunk.com/t5/Splunk-Search/Dynamic-defaults-for-index-time-field-extraction/m-p/104799#M27163 <P>Not really at index time but you can at search time like this:</P> <PRE><CODE>| streamstats MyFieldAlways=last(MyField) | &lt;your normal search stuff but use "MyFieldAlways" instead of "MyField"&gt; </CODE></PRE> Wed, 27 May 2015 05:41:04 GMT woodcock 2015-05-27T05:41:04Z https://community.splunk.com/t5/Splunk-Search/Dynamic-defaults-for-index-time-field-extraction/m-p/104798#M27162 <P>I've a couple of index-time field extractions. In events that are missing one of these fields, is there a way to assign the most recently extracted value for that field from this source/sourcetype? The same behavior I see with timestamp inference, I'd like to be able to have for a non-default field extraction.</P> Wed, 15 Dec 2010 06:22:00 GMT https://community.splunk.com/t5/Splunk-Search/Dynamic-defaults-for-index-time-field-extraction/m-p/104798#M27162 welchatquietple 2010-12-15T06:22:00Z https://community.splunk.com/t5/Splunk-Search/Dynamic-defaults-for-index-time-field-extraction/m-p/104799#M27163 <P>Not really at index time but you can at search time like this:</P> <PRE><CODE>| streamstats MyFieldAlways=last(MyField) | &lt;your normal search stuff but use "MyFieldAlways" instead of "MyField"&gt; </CODE></PRE> Wed, 27 May 2015 05:41:04 GMT https://community.splunk.com/t5/Splunk-Search/Dynamic-defaults-for-index-time-field-extraction/m-p/104799#M27163 woodcock 2015-05-27T05:41:04Z