How to assign/create indexed field in Splunk?

[SplunkDash]

Hello,

I have huge volume of data coming in under different source types (or indexes) for different applications/projects. Are there any ways we can assign any indexed fields for each of the data sources/indexes/apps? As an example, most of the cases ACCOUNTID and IPAddress are the unique fields for each of the applications/Projects. How would I assign these 2 fields as indexed fields? Any thoughts or recommendations would be highly appreciated. Thank you so much.

[richgalloway]

Create a props.conf file (put it in your org's custom app) with a stanza for each sourcetype.  In each stanza, put TRANSFORM setting that indexes the desired field.  You'll need a matching stanza in transforms.conf that uses FORMAT or INGEST_EVAL to index the field.

[SplunkDash]

Hello,

Using this recommended transforms.conf to have the indexed field is going to be an indexed time field extraction?  Thank you so much again!

[SplunkDash]

Hello,

Thank you so much for your quick response. Are there any other ways instead of using Transforms.conf file, as typically, we don't use transforms.conf file in our UFs/HFs push. Thank you so much.

[richgalloway]

I know of no other ways.

Transforms cannot be used in a UF.  They can only be used in HF and indexer.

[SplunkDash]

Hello,

Thank you so much for your quick response., truly appreciate it. 

The main reason we wanted to use indexed fields is to optimize the search/base search. But, using indexed field and indexed time field extraction may cause some performance issues. We have huge volume of data and a several source types/indexes with unique ACCOUNTID and IPAddress fields, do you have any recommendation how to optimize the base search (search) in real time as we require to search over a wide range/period of time. Thank you so much, any recommendations will be helpful and greatly appreciated.