Getting Data In

How to remove index-time field extractions from an index, but still keep the _raw data?

splunk_zen
Builder

We need to remove a list of index-time extracted fields while keeping the _raw data, is this possible?

The reason this came to be was we were previously using the search-time json extraction

KV_MODE=JSON

until we went for the 6.2 recommended approach,
index-time field extraction

INDEXED_EXTRACTIONS=json

obviously as soon as we set KV_MODE=none at the search head for this sourcetype (to get rid of the duplicated fields)
this only started adding the metadata for the new events coming in since that change,
guaranteeing we lost search capability over those fields (keeping spath out of the discussion) in the historical data until then.

We have to revert to the previous behaviour (search time extraction) as that historical data didn't have those fields at the time.

Help is welcome.

0 Karma

briang67
Communicator

Once data is indexed you cannot surgically remove fields. You would need to dump the data and then re-index with the correct extraction.

0 Karma
Get Updates on the Splunk Community!

Good Sourcetype Naming

When it comes to getting data in, one of the earliest decisions made is what to use as a sourcetype. Often, ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Splunk App for Anomaly Detection End of Life Announcement

Q: What is happening to the Splunk App for Anomaly Detection?A: Splunk is officially announcing the ...