Splunk Search

How to index a file without extracting fields?

New Member

I'm trying to index a file but I don't want Splunk to try to extract interesting fields. Or if it does, I want the field to be the entire contents of the file called 'contents'. Is this possible?

0 Karma
1 Solution

SplunkTrust
SplunkTrust

Fields are extracted on the search head which push out knowledge bundles to the indexers when you search

To test this, do a search in Fast Mode and notice how it does not enable field discovery which means your fields are not available.. Then do a search in Smart or Verbose mode and notice your fields are available

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

Fields are extracted on the search head which push out knowledge bundles to the indexers when you search

To test this, do a search in Fast Mode and notice how it does not enable field discovery which means your fields are not available.. Then do a search in Smart or Verbose mode and notice your fields are available

View solution in original post

0 Karma

New Member

Maybe I'm understanding indexing wrong. Are these fields are not indexed when I switch to verbose mode?

0 Karma

SplunkTrust
SplunkTrust

You technically can extract fields at index time, but its not recommended to do so for performance issues. Fields are extracted at search time by the search head, hence why the fields are available depending on which search mode you use.

You only index the data once which is when it goes from your forwarder to the indexer. The data is available to be searched on the indexer, but fields will be available because they are defined on the SH which push knowledge bundles to the indexers when the indexers begin to search the data

Remember that indexers are responsible for indexing AND searching the data

0 Karma

New Member

It all makes sense now. Thanks for your help.

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!