https://community.splunk.com/t5/Splunk-Search/Do-we-have-to-write-fields-conf-file-for-every-indexed-field/m-p/282144#M85163 <P>Yes, you have to include an entry in fields.conf on the Search Head for all Indexed fields that are extracted manually, i.e., not index-time extracted fields from INDEXED_EXTRACTIONS in props.conf.</P> Tue, 21 Feb 2017 10:01:46 GMT rjthibod 2017-02-21T10:01:46Z https://community.splunk.com/t5/Splunk-Search/Do-we-have-to-write-fields-conf-file-for-every-indexed-field/m-p/282143#M85162 <P>Hi I have extracted ipaddress during indextime.</P> <P>Do I have to use fields.conf for every time I during the Index time extraction.</P> <P>[ipaddress]<BR /> INDEXED=true</P> <P>Does "WRITE_META=true" is not sufficient for storing values. </P> Wed, 08 Feb 2017 16:12:46 GMT https://community.splunk.com/t5/Splunk-Search/Do-we-have-to-write-fields-conf-file-for-every-indexed-field/m-p/282143#M85162 ankithreddy777 2017-02-08T16:12:46Z https://community.splunk.com/t5/Splunk-Search/Do-we-have-to-write-fields-conf-file-for-every-indexed-field/m-p/282144#M85163 <P>Yes, you have to include an entry in fields.conf on the Search Head for all Indexed fields that are extracted manually, i.e., not index-time extracted fields from INDEXED_EXTRACTIONS in props.conf.</P> Tue, 21 Feb 2017 10:01:46 GMT https://community.splunk.com/t5/Splunk-Search/Do-we-have-to-write-fields-conf-file-for-every-indexed-field/m-p/282144#M85163 rjthibod 2017-02-21T10:01:46Z