https://community.splunk.com/t5/Knowledge-Management/How-to-save-new-field-which-created-with-cefkv-command/m-p/296396#M5499 <P>How to save new field, which created with |cefkv command?<BR /> When I don't use |cefkv command my new fileds disappear. <BR /> I want to save fields in index with events</P> Fri, 16 Feb 2018 09:02:00 GMT Shyngys_Bolatbe 2018-02-16T09:02:00Z https://community.splunk.com/t5/Knowledge-Management/How-to-save-new-field-which-created-with-cefkv-command/m-p/296396#M5499 <P>How to save new field, which created with |cefkv command?<BR /> When I don't use |cefkv command my new fileds disappear. <BR /> I want to save fields in index with events</P> Fri, 16 Feb 2018 09:02:00 GMT https://community.splunk.com/t5/Knowledge-Management/How-to-save-new-field-which-created-with-cefkv-command/m-p/296396#M5499 Shyngys_Bolatbe 2018-02-16T09:02:00Z https://community.splunk.com/t5/Knowledge-Management/How-to-save-new-field-which-created-with-cefkv-command/m-p/296397#M5500 <P>It is one of the benefits of Splunk to apply field definitions at search time.<BR /> If you really need it, you can also use the collect command to save the search results in the summary index.<BR /> You can also define fields if you do not want to use the cefkv command.</P> Fri, 16 Feb 2018 10:18:40 GMT https://community.splunk.com/t5/Knowledge-Management/How-to-save-new-field-which-created-with-cefkv-command/m-p/296397#M5500 HiroshiSatoh 2018-02-16T10:18:40Z https://community.splunk.com/t5/Knowledge-Management/How-to-save-new-field-which-created-with-cefkv-command/m-p/296398#M5501 <P>New (1.5.0+) versions of <A href="https://splunkbase.splunk.com/app/487">CEF Extraction Add-on for Splunk</A> have transforms that can be used to extract custom CEF fields without <CODE>| cefkv</CODE> <BR /> command</P> Mon, 28 May 2018 20:22:56 GMT https://community.splunk.com/t5/Knowledge-Management/How-to-save-new-field-which-created-with-cefkv-command/m-p/296398#M5501 IgorB 2018-05-28T20:22:56Z