topic Re: Custom Fields at index Time in Splunk Search

Custom Fields at index Time

adityapavan18 — Fri, 02 Aug 2013 11:25:02 GMT

I know that splunk automatically creates default fields like host,sourcetype,index at index time.And also the splunk provides a option to create any new fields also during index time.

My requirement is that a new field needs to be added at indextime called Component.
Its a constant value based on host and is not available in the eventlogs. Can anyone please suggest the way to do this

Re: Custom Fields at index Time

Ayn — Fri, 02 Aug 2013 11:32:28 GMT

Something like this. props.conf:

[your_sourcetype_here]
TRANSFORMS-addcomponent = addcomponent

transforms.conf:

[addcomponent]
SOURCE_KEY = MetaData:Host
REGEX = replace_with_your_host_here
FORMAT = component::your_value_here
WRITE_META = true

I haven't tried this out (I've no Splunk instance to test it on at the moment) but hopefully you get the general idea.

Re: Custom Fields at index Time

adityapavan18 — Mon, 05 Aug 2013 13:54:05 GMT

Thnx a lot. Tried it and that worked