Extracting Fields in search time

[misteryuku]

What is the purpose of creating a search time extracted field while i still can use search commands to retrieve he fields during the search?

[Ayn]

?

Fields are generally extracted at search time. Without these extractions there would be no fields for you to retrieve. Also I don't understand what search commands you mean that you're using for retrieving fields, please clarify.

And for the umpteenth time, read the docs.

[Ayn]

Like I said, without search-time field extractions there would be no fields for you to retrieve. Splunk extracts some fields automatically - if it finds text like "fieldX=valueX" in the raw event, the field "fieldX" will be created with the value "valueX". This is also a search-time field extraction that is done automatically for you. If you're already getting all the fields you need through this technique, it is true that you don't need to define any more field extractions yourself.

[misteryuku]

for example , when i search using this command : search sourcetype=sampledata | fields* then i can retrieve the results with the fields and the fields that i created before sending to the receivers REST endpoint.