indexed field

indexed field


A field that is incorporated into the index at index time. Indexed fields include the default fields, such as host, source, and sourcetype, as well as custom index-time field extractions. In rare cases, there is some value to adding fields to the index. However, this can negatively affect indexing performance and search times across your entire deployment. There is no way to modify or remove field extractions afterwards.

You can add non-indexed fields, which are extracted at search time.

For more information

In the Knowledge Manager Manual:

In Managing Indexers and Clusters of Indexers:

In Getting Data In: