<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic How to add field with random value at index time in Getting Data In</title>
    <link>https://community.splunk.com/t5/Getting-Data-In/How-to-add-field-with-random-value-at-index-time/m-p/184179#M36862</link>
    <description>&lt;P&gt;Hello,&lt;/P&gt;

&lt;P&gt;I have a quick question : &lt;/P&gt;

&lt;P&gt;There is a way at index time to add a field witch could represent something like an event_id ? &lt;/P&gt;

&lt;P&gt;Something like this :&lt;/P&gt;

&lt;P&gt;&lt;CODE&gt;FORMAT = event_id::&amp;lt;any_random_value&amp;gt; &lt;/CODE&gt;&lt;/P&gt;

&lt;P&gt;At this time I don't know how to generate a unique value to replace &lt;ANY_RANDOM_VALUE&gt;&lt;/ANY_RANDOM_VALUE&gt;&lt;/P&gt;

&lt;P&gt;Thanks,&lt;/P&gt;</description>
    <pubDate>Wed, 12 Mar 2014 17:00:21 GMT</pubDate>
    <dc:creator>Micmac</dc:creator>
    <dc:date>2014-03-12T17:00:21Z</dc:date>
    <item>
      <title>How to add field with random value at index time</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-to-add-field-with-random-value-at-index-time/m-p/184179#M36862</link>
      <description>&lt;P&gt;Hello,&lt;/P&gt;

&lt;P&gt;I have a quick question : &lt;/P&gt;

&lt;P&gt;There is a way at index time to add a field witch could represent something like an event_id ? &lt;/P&gt;

&lt;P&gt;Something like this :&lt;/P&gt;

&lt;P&gt;&lt;CODE&gt;FORMAT = event_id::&amp;lt;any_random_value&amp;gt; &lt;/CODE&gt;&lt;/P&gt;

&lt;P&gt;At this time I don't know how to generate a unique value to replace &lt;ANY_RANDOM_VALUE&gt;&lt;/ANY_RANDOM_VALUE&gt;&lt;/P&gt;

&lt;P&gt;Thanks,&lt;/P&gt;</description>
      <pubDate>Wed, 12 Mar 2014 17:00:21 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-to-add-field-with-random-value-at-index-time/m-p/184179#M36862</guid>
      <dc:creator>Micmac</dc:creator>
      <dc:date>2014-03-12T17:00:21Z</dc:date>
    </item>
    <item>
      <title>Re: How to add field with random value at index time</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-to-add-field-with-random-value-at-index-time/m-p/184180#M36863</link>
      <description>&lt;P&gt;No. If you're after getting unique id's for events, you could have a look at the &lt;CODE&gt;_cd&lt;/CODE&gt; field which contains a bucket ID and an address within that bucket. A combination of &lt;CODE&gt;index&lt;/CODE&gt; and &lt;CODE&gt;_cd&lt;/CODE&gt; will be unique.&lt;/P&gt;</description>
      <pubDate>Wed, 12 Mar 2014 19:09:47 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-to-add-field-with-random-value-at-index-time/m-p/184180#M36863</guid>
      <dc:creator>Ayn</dc:creator>
      <dc:date>2014-03-12T19:09:47Z</dc:date>
    </item>
  </channel>
</rss>

