In some log formats, multiple pieces of information may be encoded into a single word without whitespace or punctuation to separate the useful pieces of information. For instance, consider a log message such as this:
4/2/12 6:35:50.000 PM kernel: abc5s2: 0xc014 (UNDEFINED).
Let's pretend that 5s2 (a made-up string of characters for an example) is an important piece of information that we need to be able to search for efficiently. The query *5s2 would find the events but would be a very inefficient search (in essence, a full table scan). By defining an indexed field, you can very efficiently search for this instance of the string 5s2, because essentially, we create a new word in the metadata of this ...
