Deployment Architecture
Highlighted

Are search head field extractions superficial?

Contributor

Newbie here.

So, I have learned that there are two types of field extractions: those that happen during the input phase and those that are created on search heads, such as Calculated Fields, Field Aliases, and other field extractions. I'd like to know better if these field extractions happen only during search-time and are RAM-dependent or are permanently disk-written changes made to the index.

Like, if I made a calculated field called "Status" today and it works as it expected, then I turn it of (disable or delete) 5 days from now, will the the events today up to 5 days permanently going to consider the "Status" calculated field even if that's already deleted?

Thanks in advance.

0 Karma
Highlighted

Re: Are search head field extractions superficial?

Ultra Champion

Search time extractions are performed again and again at search time, they are not made persistent.

View solution in original post

Highlighted

Re: Are search head field extractions superficial?

Contributor

does this include Field Extractions (delimiter / regex)?

0 Karma
Highlighted

Re: Are search head field extractions superficial?

Ultra Champion

Yes.

Unless you explicitly defined them in props and transforms (e.g. using TRANSFORMS statement in props.conf) as index time extractions. But then you also need to store that config on indexers and heavy forwarders.

Highlighted

Re: Are search head field extractions superficial?

hey @morethanyell, Looks like @FrankVl was able to help you out! Would you mind tossing him an up vote? Our users love them up votes!

0 Karma