https://community.splunk.com/t5/Splunk-Search/field-extractions-on-indexer/m-p/107923#M28082 <P>Is it possible to define field extractions on the indexer and allowing the search head to use the extractions? Or can they only be defined on the search head?</P> Fri, 26 Jul 2013 18:59:45 GMT aaronkorn 2013-07-26T18:59:45Z https://community.splunk.com/t5/Splunk-Search/field-extractions-on-indexer/m-p/107923#M28082 <P>Is it possible to define field extractions on the indexer and allowing the search head to use the extractions? Or can they only be defined on the search head?</P> Fri, 26 Jul 2013 18:59:45 GMT https://community.splunk.com/t5/Splunk-Search/field-extractions-on-indexer/m-p/107923#M28082 aaronkorn 2013-07-26T18:59:45Z https://community.splunk.com/t5/Splunk-Search/field-extractions-on-indexer/m-p/107924#M28083 <P>What you usally do is define search time field extractions, which are defined on the search head. The search head will then push those configurations (called knowledge bundle) to the indexers when you search. The bundle is updated when you update the configuration. </P> <P>You can add fields at index time on the indexers when data is indexed this is usually not recommended because of possible performance issues, but it depends on your use case.</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/5.0.3/Data/Configureindex-timefieldextraction">http://docs.splunk.com/Documentation/Splunk/5.0.3/Data/Configureindex-timefieldextraction</A></P> Fri, 26 Jul 2013 19:03:41 GMT https://community.splunk.com/t5/Splunk-Search/field-extractions-on-indexer/m-p/107924#M28083 chris 2013-07-26T19:03:41Z https://community.splunk.com/t5/Splunk-Search/field-extractions-on-indexer/m-p/107925#M28084 <P>If we create a field extraction in indexer and try to fetch the details from Search head. It will not appear.</P> Wed, 03 Apr 2019 16:22:39 GMT https://community.splunk.com/t5/Splunk-Search/field-extractions-on-indexer/m-p/107925#M28084 saravanan90 2019-04-03T16:22:39Z