Does INDEXED_EXTRACTIONS imply index fields for all the fields?

[spl_aficionado]

I just set INDEXED_EXTRACTIONS = CSV for a large data ingestion sourcetype, and validating with tstats, and it seems that all the fields are indexed fields, is it true in general including for JSON? Is there any way around it of not making them indexed fields?

[gcusello]

Hi @spl_aficionado ,

using INDEXED_EXTRACTIONS=csv, you extract all the fields, but they aren't indexed time fields.

If you mead extracted fields, yes all fields are extracted, if you mean indexed fields, they aren't indexed fields.

Ciao.

Giuseppe

[richgalloway · Accepted solution]

Yes, setting INDEXED_EXTRACTIONS=JSON will index all of the fields in each event.  There is no way to prevent that, which is why many recommend against using INDEXED_EXTRACTIONS at all.