topic Re: Add a field to a sourcetype with a static value in Getting Data In

Add a field to a sourcetype with a static value

daniel333 — Wed, 30 Mar 2016 21:29:29 GMT

I wanted to add a field to a specific sourcetype

basically

nocmessage="ignore this server"

Seemed easy enough
props.conf

EVAL-nocmessage="ignore this server"

But doesn't seem to work. If I toss that same message into a if statement it how ever does work. Is there a trick to this?

somesoni2 — Wed, 30 Mar 2016 21:50:46 GMT

Where do you add this to props.conf ? I hope it's search head and you restarted your splunk instance after the change.

lguinn2 — Wed, 30 Mar 2016 21:57:36 GMT

What are the permissions on the calculated field that you created? Is it visible in only one app, or is it global, etc?

daniel333 — Wed, 30 Mar 2016 23:39:02 GMT

Turns out I was being too impatient waiting for the search head cluster to sync.

😞