Getting Data In

How find index-time field extractions.

Path Finder

Hello all,

Our environment has some custom index-time field extractions we find to be very useful (yes, I know Splunk doesn't recommend this). Though due to the possible performance implications of this practice, I want to be 100% confident I know where all index-time fields exist in our indexes.

At first, I thought this would be easy, throw a |tstats command together... when it dawned on me I have no idea how to do this.

So, if anyone can think of how to get a list of indexes/sources/sourcetypes which contain non-standard index-time field extractions, that'd be a life-saver!

Thanks for any help.

0 Karma

Communicator

| tstats count where index=yourindex by yourindexedfield

If it works, you're in business, if not... sadly no.

You could also do a conventional search like

index=foo fieldname::value

If that works, it's an indexed field.

Splunk Employee
Splunk Employee

Ill add to this that you need to make sure you have the correct configurations deployed on your SH for indexed fields for them to be properly recognized via *fields.conf ( https://docs.splunk.com/Documentation/Splunk/8.0.0/Data/Configureindex-timefieldextraction)

0 Karma