How to remove index-time field extractions from an index, but still keep the _raw data?

[splunk_zen]

We need to remove a list of index-time extracted fields while keeping the _raw data, is this possible?

The reason this came to be was we were previously using the search-time json extraction

KV_MODE=JSON

until we went for the 6.2 recommended approach,
index-time field extraction

INDEXED_EXTRACTIONS=json

obviously as soon as we set KV_MODE=none at the search head for this sourcetype (to get rid of the duplicated fields)
this only started adding the metadata for the new events coming in since that change,
guaranteeing we lost search capability over those fields (keeping spath out of the discussion) in the historical data until then.

We have to revert to the previous behaviour (search time extraction) as that historical data didn't have those fields at the time.

Help is welcome.

[briang67]

Once data is indexed you cannot surgically remove fields. You would need to dump the data and then re-index with the correct extraction.