What you usally do is define search time field extractions, which are defined on the search head. The search head will then push those configurations (called knowledge bundle) to the indexers when you search. The bundle is updated when you update the configuration.
You can add fields at index time on the indexers when data is indexed this is usually not recommended because of possible performance issues, but it depends on your use case.
http://docs.splunk.com/Documentation/Splunk/5.0.3/Data/Configureindex-timefieldextraction
