Are search head field extractions superficial?

[morethanyell]

Newbie here.

So, I have learned that there are two types of field extractions: those that happen during the input phase and those that are created on search heads, such as Calculated Fields, Field Aliases, and other field extractions. I'd like to know better if these field extractions happen only during search-time and are RAM-dependent or are permanently disk-written changes made to the index.

Like, if I made a calculated field called "Status" today and it works as it expected, then I turn it of (disable or delete) 5 days from now, will the the events today up to 5 days permanently going to consider the "Status" calculated field even if that's already deleted?

Thanks in advance.

[FrankVl · Accepted solution]

Search time extractions are performed again and again at search time, they are not made persistent.

[morethanyell]

does this include Field Extractions (delimiter / regex)?

[mstjohn_splunk]

hey @morethanyell, Looks like @FrankVl was able to help you out! Would you mind tossing him an up vote? Our users love them up votes!

[FrankVl]

Yes.

Unless you explicitly defined them in props and transforms (e.g. using TRANSFORMS statement in props.conf) as index time extractions. But then you also need to store that config on indexers and heavy forwarders.