field extractions on indexer

[aaronkorn]

Is it possible to define field extractions on the indexer and allowing the search head to use the extractions? Or can they only be defined on the search head?

[saravanan90]

If we create a field extraction in indexer and try to fetch the details from Search head. It will not appear.

[chris]

What you usally do is define search time field extractions, which are defined on the search head. The search head will then push those configurations (called knowledge bundle) to the indexers when you search. The bundle is updated when you update the configuration.

You can add fields at index time on the indexers when data is indexed this is usually not recommended because of possible performance issues, but it depends on your use case.

http://docs.splunk.com/Documentation/Splunk/5.0.3/Data/Configureindex-timefieldextraction