Splunk Search

field extractions on indexer

Splunk Employee
Splunk Employee

Is it possible to define field extractions on the indexer and allowing the search head to use the extractions? Or can they only be defined on the search head?

Path Finder

If we create a field extraction in indexer and try to fetch the details from Search head. It will not appear.

0 Karma


What you usally do is define search time field extractions, which are defined on the search head. The search head will then push those configurations (called knowledge bundle) to the indexers when you search. The bundle is updated when you update the configuration.

You can add fields at index time on the indexers when data is indexed this is usually not recommended because of possible performance issues, but it depends on your use case.