A type of field extraction that uses the
KV_MODE attribute in
props.conf to automatically extract fields for events associated with a specific host, source, or source type. Automatic key-value field extractions come third in the sequence of search time operations, before field aliases but after inline field extractions and transform field extractions. Automatic key-value field extractions are on by default and can be configured in
props.conf. Automatic key-value field extractions is one of three types of search-time field extractions. See transform field extractions or inline field extractions for more information.
For more information
In the Knowledge Manager Manual: