I have did index time extractions for fields.
I have stored them in _meta. But when I search for the extracted field values, It is taking same time as search time extractions. Is there any query to search for index time extracted fields stored under _meta. Or should I store the extracted fields at different place for fast search of the queries.
I'm guessing you need do add an entry in the fields.conf, on Search head for the new indexed time extracted field, so that they are treated as such. See this for more info.
If your only dealing with indexed field in your query and want to just list/do aggregation on them, you can use tstats command which works on metadata/indexed fields. Something like this
| tstats count WHERE index-my_index_name sourcetype="Good to Specify" by err_code | table
It'll be super duper fast then regular search.
It is something like
REGEX = deviceid=[w+](?[^:]+)
FORMAT = errcode::$1
WRITE_META = true
and my search is ,
Is there any way to search error_code values quickly
You can reference indexed fields using the syntax
You can also try this and see if it returns data:
| tstats count where index=my_index_name by error_code
If it doesn't produce a result, you may want to use the walklex command to validate that your field actually appears in the index.