Splunk Search

Extracting Fields in search time

misteryuku
Communicator

What is the purpose of creating a search time extracted field while i still can use search commands to retrieve he fields during the search?

0 Karma

Ayn
Legend

?

Fields are generally extracted at search time. Without these extractions there would be no fields for you to retrieve. Also I don't understand what search commands you mean that you're using for retrieving fields, please clarify.

And for the umpteenth time, read the docs.

Ayn
Legend

Like I said, without search-time field extractions there would be no fields for you to retrieve. Splunk extracts some fields automatically - if it finds text like "fieldX=valueX" in the raw event, the field "fieldX" will be created with the value "valueX". This is also a search-time field extraction that is done automatically for you. If you're already getting all the fields you need through this technique, it is true that you don't need to define any more field extractions yourself.

0 Karma

misteryuku
Communicator

for example , when i search using this command : search sourcetype=sampledata | fields* then i can retrieve the results with the fields and the fields that i created before sending to the receivers REST endpoint.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...