Consider a web access log with a trailing request time in microseconds:
[31/Jan/2012:18:18:07 +0000] "GET / HTTP/1.1" 200 7918 "" "Mozilla/5.0..." 11/11033255
Let's say we want to find all requests that took longer than 10 seconds. We can easily extract the value into a field, perhaps request_ms. We could then run the search request_ms>10000000. This query will work, but it requires scanning every event in the given time frame. Whether the field is extracted or indexed, we would face the same problem, as Splunk has to convert the field value to a number before it can test the value.
What if we could define a field and instead search for slow_request=1? To do this, we can take advantage of the fact that, ...
