How to index a file without extracting fields?

[leunammejii]

I'm trying to index a file but I don't want Splunk to try to extract interesting fields. Or if it does, I want the field to be the entire contents of the file called 'contents'. Is this possible?

[skoelpin · Accepted solution]

Fields are extracted on the search head which push out knowledge bundles to the indexers when you search

To test this, do a search in Fast Mode and notice how it does not enable field discovery which means your fields are not available.. Then do a search in Smart or Verbose mode and notice your fields are available

[leunammejii]

Maybe I'm understanding indexing wrong. Are these fields are not indexed when I switch to verbose mode?

[skoelpin]

You technically can extract fields at index time, but its not recommended to do so for performance issues. Fields are extracted at search time by the search head, hence why the fields are available depending on which search mode you use.

You only index the data once which is when it goes from your forwarder to the indexer. The data is available to be searched on the indexer, but fields will be available because they are defined on the SH which push knowledge bundles to the indexers when the indexers begin to search the data

Remember that indexers are responsible for indexing AND searching the data

[leunammejii]

It all makes sense now. Thanks for your help.