
Configure indexed field extraction
There are three types of fields that Splunk can extract at index time:
- Default fields
- Custom fields
- File header fields
Splunk always extracts a set of default fields for each event. You can configure it to also extract custom and, for some data, file header fields.
For more information on indexed field extraction, see the chapter "Configure indexed field extraction" in this manual.
PREVIOUS Configure event timestamps |
NEXT Anonymize data |
This documentation applies to the following versions of Splunk® Enterprise: 4.3, 4.3.1, 4.3.2, 4.3.3, 4.3.4, 4.3.5, 4.3.6, 4.3.7, 5.0, 5.0.1, 5.0.2, 5.0.3, 5.0.4, 5.0.5, 5.0.6, 5.0.7, 5.0.8, 5.0.9, 5.0.10, 5.0.11, 5.0.12, 5.0.13, 5.0.14, 5.0.15, 5.0.16, 5.0.17, 5.0.18
Feedback submitted, thanks!