field extraction

field extraction

noun

Both the process by which Splunk Enterprise extracts fields from event data and the results of that process, are referred to as extracted fields. Splunk Enterprise extracts a set of default fields for each event it indexes. Field extraction can take place either before event indexing (in the case of default fields and indexed fields) or after event indexing (in the case of search fields). You can also create custom fields by defining additional index-time and search-time field extractions, using search commands, the field extractor, or configuration files.

For more information

In the Knowledge Manager Manual:

• Build field extractions with the field extractor
• Use the Field Extractions page in Splunk Web
• Create and maintain search-time field extractions through configuration files

In the Search Manual:

• Extract fields with search commands

In Getting Data In:

• Create custom fields at index time