How to use field extractions?
There are multiple was to extract fields:
you can use the interactive field extration present in search
you can using inline rex command in your search
you can use props and transforms conf files
There is also the option to use the search -> sidebar -> extract more fields -> and use the automatic field extractor, though this is most often just a jumping-off point for your final field extractions.
You can write a search time field extraction under splunk -> settings -> field extractions. A field extraction will apply to a sourcetype and can be either an inline regex based extraction, or use a TRANSFORM from transforms. conf.
You can also extract fields at indextime using transforms.conf on the indexer/HF