Which of the following methods is valid for creating index-time field extractions?

Question

Simon Tam · Accepted Answer

Create a configuration app with the index-time props.conf and/or transfoms. conf, and upload the app via UI.

Simon Tam · Answer

Use the UI to create a sourcetype, specify the field name and corresponding regular expression with capture statement.

Simon Tam · Answer

Use the CU app to define settings in fields.conf, and restart Splunk Cloud.

Simon Tam · Answer

Use the rex command to extract the desired field, and then save as a calculated field.

List of questions