Getting Data In

field extraction

vijaysri
Contributor

Hi,

How to find whether a field is extracted at index time (or) search time?

Labels (1)

soutamo
SplunkTrust
SplunkTrust

Hi

You could use walklex command to get list of index time extractions. Rest of fields are search time extracted.

 

| walklex index=main type=field
| dedup field
| table field

 

https://docs.splunk.com/Documentation/Splunk/8.1.0/SearchReference/Walklex

r. Ismo 

vijaysri
Contributor

I am getting below error in Splunk PROD

Unknown search command 'walklex'.

0 Karma

soutamo
SplunkTrust
SplunkTrust
HI
this command has come on version 7.3.0. If you have older version then it's time to update anyhow as 7.2 is quite soon out of support.
Before that you could search from answers what are other ways to get this information.
r. Ismo