Regardless of how you are using the data in Splunk to solve business problems, you'll be working with the values in various fields within each event. Splunk extracts event fields in three ways:
- Index-time: Fields are extracted and stored when events are indexed
- Search-time: Fields are automatically extracted from key-value pairs in each event
- Explicitly extracted fields: Fields are created from specified locations within each event at search time
And as discussed in Chapter 6, Searching with Splunk, you can use Splunk commands, such as eval and stats, to create new fields from data in existing fields.
