Getting Data In

index time field extraction


When I do index time field extraction will Splunk create a new separate index for the values in the extracted field ( For example a B-tree index) or will Splunk add key=value pairs as keywords to the existing full-text indexes found in the *.tsidx files?

Tags (2)


Splunk adds key-value pairs. Unless you have a very specific (and unusual) situation, index time field extraction will not improve performance. However, it is more complex, more error-prone and inflexible. This is why Splunk strongly encourages you to use search time field extractions. Index time field extraction is not faster - with very rare exceptions. Do not use it unless you must.

Splunk field extractions and Splunk indexing are not the same as relational database indexes. They are not remotely equivalent from a functional configuration perspective.

Did I say "don't use index time field extraction" often enough? I can say it again...

Also see this answer: Search-time versus index-time field extractions

Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...

Reminder! Splunk Love Promo: $25 Visa Gift Card for Your Honest SOAR Review With ...

We recently launched our first Splunk Love Special, and it's gone phenomenally well, so we're doing it again, ...