Splunk Search

Extracting Fields in search time

Communicator

What is the purpose of creating a search time extracted field while i still can use search commands to retrieve he fields during the search?

0 Karma

Legend

?

Fields are generally extracted at search time. Without these extractions there would be no fields for you to retrieve. Also I don't understand what search commands you mean that you're using for retrieving fields, please clarify.

And for the umpteenth time, read the docs.

Legend

Like I said, without search-time field extractions there would be no fields for you to retrieve. Splunk extracts some fields automatically - if it finds text like "fieldX=valueX" in the raw event, the field "fieldX" will be created with the value "valueX". This is also a search-time field extraction that is done automatically for you. If you're already getting all the fields you need through this technique, it is true that you don't need to define any more field extractions yourself.

0 Karma

Communicator

for example , when i search using this command : search sourcetype=sampledata | fields* then i can retrieve the results with the fields and the fields that i created before sending to the receivers REST endpoint.

0 Karma