Splunk Enterprise

What is the role of INDEXED_VALUE in fields.conf

Path Finder


There is the description for INDEXED_VALUE in fields.conf

INDEXED_VALUE = [true|false|<sed-cmd>|<simple-substitution-string>]
* Set this to true if the value is in the raw text of the event.
* Set this to false if the value is not in the raw text of the event.
* Setting this to true expands any search for key=value into a search of
  value AND key=value (since value is indexed).

* NOTE: You only need to set indexed_value if indexed = false.

INDEXED_VALUE is used when indexed = false according to the description. Then, when is the option INDEXED_VALUE used? Which circumstances require this option?

Is there a case where only value is indexed and key(field) is not indexed?

The description makes me confused.. Hope anyone help me out.

Thanks a lot.

Labels (2)
0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!