Guide119K views1,604 votes0 replies2,842 following
Configure Splunk Index-time Field Extractions with props.conf and transforms.conf
Shift recurring field extraction from search time to ingestion to reduce search CPU, with caveats about permanence and index size.
splunk