automatic key value field extraction

automatic key value field extraction


A type of field extraction that uses the KV_MODE attribute in props.conf to automatically extract fields for events associated with a specific host, source, or source type. Automatic key-value field extractions come third in the sequence of search time operations, before field aliases but after inline field extractions and transform field extractions. Automatic key-value field extractions are on by default and can be configured in props.conf. Automatic key-value field extractions is one of three types of search-time field extractions. See transform field extractions or inline field extractions for more information.

Related terms

For more information

In the Knowledge Manager Manual: