When Splunk software extracts fields
Field extraction at index time
Caution: Do not add custom fields to the set of default fields that Splunk software extracts and indexes at index time. Adding to this list of fields can slow indexing performance and search times, because each indexed field increases the size of the searchable index. Indexed fields are also less flexible, because whenever you make changes to your set of indexed fields, you must re-index your entire dataset. See "Index time versus search time" in the Managing Indexers and Clusters manual.
Field extraction at search time
When field discovery is enabled, Splunk software:
- Identifies and extracts the first 100 fields that it finds in the event data that match obvious
key=valuepairs. This 100 field limit is a default that you can modify by editing the
limits.conf, if you have Splunk Enterprise.
- Extracts any field explicitly mentioned in the search that it might otherwise have found though automatic extraction, but is not among the first 100 fields identified.
- Performs custom field extractions that you have defined, either through the Field Extractor, the Extracted Fields page in Settings, configuration file edits, or search commands such as
When field discovery is disabled, Splunk software extracts:
- Any field explicitly mentioned in the search.
- The default and indexed fields mentioned above.
- Any custom field extraction that has the
CAN_OPTIMIZEparameter set to true in
Splunk software discovers fields other than default fields and fields explicitly mentioned in the search string only when you:
- Run a non-transforming search in the Smart search mode.
- Run any search in the Verbose search mode.
See "Set search mode to adjust your search experience" in the Search Manual.
For an explanation of search time and index time, see "Index time versus search time" in the Managing Indexers and Clusters manual.
Example of automatic field extraction
This is an example of how Splunk software automatically extracts fields without user help, as opposed to custom field extractions, which follow event-extraction rules that you define.
Say you search on
sourcetype, a default field that Splunk software extracts for every event at index time. If your search is
for the past 24 hours, Splunk software returns every event with a sourcetype of
veeblefetzer in that time range. From this set of events, Splunk software extracts the first 100 fields that it can identify on its own. And it performs extractions of custom fields, based on configuration files. All of these fields appear in the fields sidebar when the search is complete.
Now, if a name/value combination like
userlogin=fail appears for the first time 25,000 events into the search, and
userlogin isn't among the set of custom fields that you've preconfigured, it likely is not among the first 100 fields that Splunk software finds on its own.
However, if you change your search to
then Splunk software finds and returns all events including both the
userlogin field and a
sourcetype value of
veeblefetzer. It will be available in the field sidebar along with the other fields extracted for this search.
Build field extractions with the field extractor
This documentation applies to the following versions of Splunk® Enterprise: 6.2.0, 6.2.1, 6.2.2, 6.2.3, 6.2.4, 6.2.5, 6.2.6, 6.2.7, 6.2.8, 6.2.9, 6.2.10, 6.2.11, 6.2.12, 6.2.13, 6.2.14, 6.2.15, 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.3.8, 6.3.9, 6.3.10, 6.3.11, 6.3.12, 6.3.13, 6.3.14, 6.4.0, 6.4.1, 6.4.2, 6.4.3, 6.4.4, 6.4.5, 6.4.6, 6.4.7, 6.4.8, 6.4.9, 6.4.10, 6.4.11, 6.5.0, 6.5.1, 6.5.1612 (Splunk Cloud only), 6.5.2, 6.5.3, 6.5.4, 6.5.5, 6.5.6, 6.5.7, 6.5.8, 6.5.9, 6.5.10, 6.6.0, 6.6.1, 6.6.2, 6.6.3, 6.6.4, 6.6.5, 6.6.6, 6.6.7, 6.6.8, 6.6.9, 6.6.10, 6.6.11, 6.6.12