How to make a field as index time field extraction?

[deepthi5]

I have a log with events as below

Mar 18 10:48:31 XXXXXXXXXXXXXXX 1,2019/03/18 10:48:31,012501002228,\,url-filtering,0,2019/03/18 10:48:31,,url-cloud-connection-failure,,0,0,general,medium,"Cloud is not ready,

Where XXXXXXXXX is ectract as device hostname i.e., dvc_host

I want to make this field as a index time field extraction

I have field extracted in props and transforms and then defined dvc_host in fields.conf but still could not find the field while using tstats

[woodcock]

To be an index-time field, you cannot use EXTRACT- nor REPORT-, you must use TRANSFORMS- in props.conf and then create a transform in transforms.conf that matches and does your field extraction. This must then be pushed to the first full-instance of splunk that handles your events (HF or Indexer tier). Show us what is in your props.conf and transforms.conf.

[deepthi5]

Transforms.conf ( Where dvc_host is defined as field here )

[panfw_extract_traffic]
DELIMS = ","
FIELDS = "future_use1","receive_time","serial_number","type","log_subtype","future_use2","generated_time","src_ip","dest_ip","src_translated_ip","dest_translated_ip","rule","src_user","dest_user","app","virtual_system","src_zone","dest_zone","src_interface","dest_interface","log_forwarding_profile","future_use3","session_id","repeat_count","src_port","dest_port","src_translated_port","dest_translated_port","flags","protocol","action","bytes","bytes_out","bytes_in","packets","start_time","duration","category","future_use4","sequence_number","action_flags","src_location","dest_location","future_use5","packets_out","packets_in","session_end_reason","devicegroup_level1","devicegroup_level2","devicegroup_level3","devicegroup_level4","vsys_name","dvc_host","action_source"

Props.conf

[pan:traffic]
REPORT-panfw_extract_traffic = panfw_extract_traffic