Implementing Splunk 7, Third Edition - Third Edition

Indexed fields versus extracted fields

When an event is written to an index, the raw text of the event is captured along with a set of indexed fields. The default indexed fields include host, sourcetype, source, and _time. There are distinct advantages and a few serious disadvantages to using indexed fields.

First, let's look at the advantages of an indexed field (we will actually discuss configuring indexed fields in Chapter 11, Configuring Splunk):

• As an indexed field is stored in the index with the event itself, it is only calculated at index time, and in fact, can only be calculated once at index time.
• It can make finding specific instances of common terms efficient. See the Indexed field case 1 - rare instances of a common term section ...