I'll tell you how you said,
Click the Settings button at the top right
field button click
Press the Extract Field button and proceed.
The above operation can extract the field at the fastest speed from the standardized field.
Create an index.
Field Extractions and deploy to Indexers
Send events to index on Indexers
Field Extractions and deploy to Search Heads.
Field Extractions can be created through the GUI on the Search Head (examples of exceptions include
KV_MODE). If you are configured correctly, NO Index-Time
Field Extractions can be configured through the GUI of Indexers.