indexed field

indexed field

noun

A field that is incorporated into the index at index time. Indexed fields include the default fields, such as host, source, and sourcetype, as well as custom index-time field extractions. In rare cases, there is some value to adding fields to the index. However, this can negatively affect indexing performance and search times across your entire deployment. There is no way to modify or remove field extractions afterwards.

You can add non-indexed fields, which are extracted at search time.

For more information

In the Knowledge Manager Manual:

• About fields

In Managing Indexers and Clusters of Indexers:

• Index time versus search time

In Getting Data In:

• Create custom fields at index time