So, I have learned that there are two types of field extractions: those that happen during the input phase and those that are created on search heads, such as Calculated Fields, Field Aliases, and other field extractions. I'd like to know better if these field extractions happen only during search-time and are RAM-dependent or are permanently disk-written changes made to the index.
Like, if I made a calculated field called "Status" today and it works as it expected, then I turn it of (disable or delete) 5 days from now, will the the events today up to 5 days permanently going to consider the "Status" calculated field even if that's already deleted?
Thanks in advance.
Unless you explicitly defined them in props and transforms (e.g. using TRANSFORMS statement in props.conf) as index time extractions. But then you also need to store that config on indexers and heavy forwarders.