index time extractions search

[ankithreddy777]

I have did index time extractions for fields.
I have stored them in _meta. But when I search for the extracted field values, It is taking same time as search time extractions. Is there any query to search for index time extracted fields stored under _meta. Or should I store the extracted fields at different place for fast search of the queries.

[somesoni2]

I'm guessing you need do add an entry in the fields.conf, on Search head for the new indexed time extracted field, so that they are treated as such. See this for more info.
http://docs.splunk.com/Documentation/Splunk/6.5.2/Data/Configureindex-timefieldextraction#Add_an_ent...

If your only dealing with indexed field in your query and want to just list/do aggregation on them, you can use tstats command which works on metadata/indexed fields. Something like this

| tstats count WHERE index-my_index_name sourcetype="Good to Specify" by err_code | table 

err_code
It'll be super duper fast then regular search.

[koshyk]

would be good to have some sample example data and your props/transforms to see how you are doing it

[somesoni2]

Also, the search that you're using.

[ankithreddy777]

It is something like

[netscreen-error]
REGEX = device_id=[w+](?[^:]+)
FORMAT = err_code::$1
WRITE_META = true

and my search is ,
index=my_index_name|table err_code

Is there any way to search error_code values quickly

[s2_splunk]

You can reference indexed fields using the syntax field::value.
You can also try this and see if it returns data:

| tstats count where index=my_index_name by error_code

If it doesn't produce a result, you may want to use the walklex command to validate that your field actually appears in the index.