Is there any way to do calculated fields before search time?

[ayusuf]

I was using calculated fields, but then I started reading the documentation and saw that calculated fields are done during search-time.
https://docs.splunk.com/Documentation/Splunk/6.2.2/Knowledge/definecalcfields

I'm thinking this doesn't really give me an advantage of having it inside of the search vs outside in a calculated field in terms of performance.

Is there anyway to do the calculated field before search time? or is it only done once during the first initial search?

[martin_mueller]

The point of a calculated field is not performance, it's keeping complexity out of multiple searches.
While you usually don't gain any performance compared to an inline eval command in your search, you also don't lose any.

By moving your case expression to a calculated field, you enable every searcher to use the result without having to know about how it was computed, without having to compute it themselves in the search, without having to update the expression in dozens of places in case something changed.

Shameless plug: For detailed thoughts on calculated fields' search performance considerations, attend my .conf2016 talk 😄

[somesoni2]

Calculated fields can be created during search time only. There is no expression evaluation available at index-time (only regex replacement /extraction is available). What are doing in the calculated field BTW?

[ayusuf]

@somesoni2, I'm doing an eval, in particular a case that statement with several match expressions. Besides calculated field is there another way to create a field before search time?

[somesoni2]

There are, but as I said earlier, they can't be created using an expression, like eval-case. See more on Indexed-time field extraction here. Please note that they require additional processing time (at index time) and storage on indexers.

http://docs.splunk.com/Documentation/Splunk/6.4.2/Data/Configureindex-timefieldextraction