topic Append field to event data in Getting Data In

Append field to event data

rantravee — Mon, 14 Oct 2013 14:47:57 GMT

hello,

Using a custom script input I can obtain some data from a particular network resource. I would like to know if is possible to inject/append a field to the generated event indexed by splunk , so that I can augment my knowledge about each event.

Thanks

Re: Append field to event data

rroberts — Mon, 14 Oct 2013 15:57:05 GMT

One approach would be to leverage lookups. Checkout: http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Addfieldsfromexternaldatasources?r=searchtip

You can create field=value pairs on the the fly to augment knowledge about your events.

Re: Append field to event data

rantravee — Mon, 14 Oct 2013 19:57:03 GMT

Interesting, but there seems to be a limitation.

If I understood correctly, one can create new fields/values , but they must be somehow related to the event through an field that is already contained by the event.

I need to add/inject a field=value pair to my event , that is completely unrelated to any of it's fields.

And I need to do it on the fly . Is there any possibility to allow me to do this