thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Intermediate

Field Extraction

The process of identifying and pulling named fields out of raw event data, at index time or search time.

Definition

Splunk performs most extractions at search time using automatic key-value extraction, props.conf EXTRACT settings or the rex command. The Field Extractor tool helps build regex or delimiter-based extractions. Search-time extraction is preferred for flexibility.

Example

| rex "user=(?<username>\w+)"

Exam tip

Search-time extraction is the default and preferred approach; index-time extraction increases index size.

Related terms