Is there a way to tell if a field is an index time field (vs a search time field)?

[chris]

Hi

is there a way (in Splunk Web or from the CLI) to see if a field was extracted at search time or at index time?

Thanks

Chris

[DTERM · Accepted solution]

I don't believe this is possible.

[chris]

I guess you're right