topic Re: How to Assign/Create Indexed Field in SPLUNK? in Getting Data In

How to assign/create indexed field in Splunk?

SplunkDash — Thu, 26 May 2022 06:05:50 GMT

Hello,

I have huge volume of data coming in under different source types (or indexes) for different applications/projects. Are there any ways we can assign any indexed fields for each of the data sources/indexes/apps? As an example, most of the cases ACCOUNTID and IPAddress are the unique fields for each of the applications/Projects. How would I assign these 2 fields as indexed fields? Any thoughts or recommendations would be highly appreciated. Thank you so much.

Re: How to Assign/Create Indexed Field in SPLUNK?

richgalloway — Tue, 24 May 2022 19:39:01 GMT

Create a props.conf file (put it in your org's custom app) with a stanza for each sourcetype. In each stanza, put TRANSFORM setting that indexes the desired field. You'll need a matching stanza in transforms.conf that uses FORMAT or INGEST_EVAL to index the field.

Re: How to Assign/Create Indexed Field in SPLUNK?

SplunkDash — Tue, 24 May 2022 19:58:51 GMT

Hello,

Thank you so much for your quick response. Are there any other ways instead of using Transforms.conf file, as typically, we don't use transforms.conf file in our UFs/HFs push. Thank you so much.

Re: How to Assign/Create Indexed Field in SPLUNK?

SplunkDash — Thu, 26 May 2022 03:50:45 GMT

Hello,

Using this recommended transforms.conf to have the indexed field is going to be an indexed time field extraction? Thank you so much again!

Re: How to Assign/Create Indexed Field in SPLUNK?

richgalloway — Thu, 26 May 2022 12:28:24 GMT

I know of no other ways.

Transforms cannot be used in a UF. They can only be used in HF and indexer.

Re: How to Assign/Create Indexed Field in SPLUNK?

SplunkDash — Thu, 26 May 2022 13:44:43 GMT

Hello,

Thank you so much for your quick response., truly appreciate it.

The main reason we wanted to use indexed fields is to optimize the search/base search. But, using indexed field and indexed time field extraction may cause some performance issues. We have huge volume of data and a several source types/indexes with unique ACCOUNTID and IPAddress fields, do you have any recommendation how to optimize the base search (search) in real time as we require to search over a wide range/period of time. Thank you so much, any recommendations will be helpful and greatly appreciated.