So if I had incoming data and it goes to an indexer, would the fieldnames/fieldvalues be extracted at that point as they are being indexed or are fieldnames/fieldvalues extracted during search time?
transforms.conf/props.conf would make it so that the fieldnames/fieldvalues are extracted during indexing, correct?
Fields are extracted at search time unless Splunk is explicitly told to do so at index time. Since you didn't say to, nothing is extracted at index time.