field extraction

[VijaySrrie]

Hi,

How to find whether a field is extracted at index time (or) search time?

[isoutamo]

Hi

You could use walklex command to get list of index time extractions. Rest of fields are search time extracted.

| walklex index=main type=field
| dedup field
| table field

https://docs.splunk.com/Documentation/Splunk/8.1.0/SearchReference/Walklex

r. Ismo 

[VijaySrrie]

I am getting below error in Splunk PROD

Unknown search command 'walklex'.

[isoutamo]

HI
this command has come on version 7.3.0. If you have older version then it's time to update anyhow as 7.2 is quite soon out of support.
Before that you could search from answers what are other ways to get this information.
r. Ismo