Configure fields.conf

Configure fields.conf

Use fields.conf to configure how Splunk handles user-defined fields at index time.

Configure fields.conf to:

• Tell Splunk how to handle multi-value fields.
• Distinguish indexed and extracted fields.
• Improve search performance by telling the search processor how to handle field values.

Configuration

[<field name>]
TOKENIZER = $REGEX
INDEXED = True/False
INDEXED_VALUE = True/False

tokenizer

• Use tokenizer to configure multi-value fields.

indexed

• Indicate whether a field is indexed or not.
• Set to "true" if the field is indexed.

indexed_value

• Indicate whether the values for a field are in the index.
• For example, if you search for foo=bar, indexed_value tells search whether the value 'bar' is in the index or not (eg will the values for this field be found in _raw - the raw text of the event).
• Set indexed_value to true if the value is in the raw text of the event.
• Set it to false if the value is not in the raw text of the event.

Note: You only need to set indexed_value if indexed = false.