Indexing in splunk

[ChhayaV]

hi,
How indexing is done in splunk ? does it indexes all the raw data? if i extract some field after uploading data into splunk will those fields will be indexed?

Thanks and regards

[linu1988]

After the data is indexed, it will not be indexed anymore even if there are any manipulation on the data.

[martin_mueller]

It indexes all the raw data, your field extractions are applied at search-time. It doesn't matter when the extraction was defined in relation to the indexing.

[sowings]

Furthermore, different apps and different users can have their own individual ways of extracting fields from the same indexed data!