is it possible to execute some commands in index time

[ahmedhassanean]

i would like to know if it's possible is to execute some commands at index time .
i mean commands such as ( mvzip | mvexpand ) or any other commands
i don't want to use summary index

thanks in advance

[Jeremiah · Accepted solution]

Here is a link to the documentation that explains what can be done at index vs search time.

http://docs.splunk.com/Documentation/Splunk/6.3.3/Indexer/Indextimeversussearchtime

You can perform indexed field extractions, which might get you to what you want.

http://docs.splunk.com/Documentation/Splunk/6.3.3/Data/Configureindex-timefieldextraction

Keep in mind you can also perform field calculations automatically at search time, which could also effectively give you the same thing.

http://docs.splunk.com/Documentation/Splunk/6.3.3/Knowledge/definecalcfields