What is Fields? and field extraction in splunk?

[surbhiQA]

What is Field? what is field extraction in Splunk? where and how i is used?

[kamlesh_vaghela]

Hi @surbhiQA,

Can you please see this link? I think it will help you.

http://docs.splunk.com/Documentation/Splunk/7.0.2/Knowledge/Aboutfields
https://docs.splunk.com/Documentation/Splunk/7.0.2/SearchTutorial/Usefieldstosearch

Thanks

[deepashri_123]

Hi surbhiQA,

Fields is a searchable name/value pair in Splunk Enterprise event data.

Both the process by which Splunk Enterprise extracts fields from event data and the results of that process, are referred to as extracted fields. Splunk Enterprise extracts a set of default fields for each event it indexes. Field extraction can take place either before event indexing (in the case of default fields and indexed fields) or after event indexing (in the case of search fields). You can also create custom fields by defining additional index-time and search-time field extractions, using search commands, the field extractor, or configuration files.

Reference:
http://docs.splunk.com/Documentation/Splunk/7.0.2/Knowledge/Aboutfields
https://docs.splunk.com/Documentation/Splunk/7.0.2/SearchTutorial/Usefieldstosearch
http://docs.splunk.com/Documentation/Splunk/7.0.2/Knowledge/ExtractfieldsinteractivelywithIFX