Are the fields created using a summary index "index-time" fields?

[a212830]

Hi,

I am creating a summary index, and want to makes these fields available via tstats - is that possible?

[woodcock · Accepted solution]

It is either/or. If you need tstats then you should use an Accelerated Data Model instead of Summary Index:

http://docs.splunk.com/Documentation/Splunk/6.6.1/Knowledge/Acceleratedatamodels

[a212830]

Thanks!

[rjthibod]

No they are not index-time fields by default.

You will have to define custom index-field extractions using transforms.conf or props.conf settings in order to achieve that.

I assume you are not using the si- commands to generate the fields and, therefore, likely using another sourcetype other than stash. If you are and you are using the collect command to do this, please note that you are impacting your indexing volume license allocation.