https://community.splunk.com/t5/Splunk-Search/Creating-new-fields-and-setting-values-for-fields-retrieved-on/m-p/100101#M25876 <P>splunk_server is a reserved field used by Splunk. You should choose non-reserved field names. </P> <P>You can confirm this by searching any event that does not contain your splunk_server key=value and see that the field exists in every event.</P> Tue, 26 Jan 2016 17:40:18 GMT the_wolverine 2016-01-26T17:40:18Z https://community.splunk.com/t5/Splunk-Search/Creating-new-fields-and-setting-values-for-fields-retrieved-on/m-p/100100#M25875 <P>I put the key value pairs of the log message into the content body whenever i create new events throught the splunk's receiver endpoint, so that i can see new fields being added.</P> <P>hater = yes, nothater = suck, splunk_server=L33603</P> <P>splunk_server field was retrieved during serach and i set the value to it. When i sent the data for indexing, the new fields are created but the value of the splunk_server field wasn't the value that i set.</P> Mon, 28 Sep 2020 11:34:18 GMT https://community.splunk.com/t5/Splunk-Search/Creating-new-fields-and-setting-values-for-fields-retrieved-on/m-p/100100#M25875 misteryuku 2020-09-28T11:34:18Z https://community.splunk.com/t5/Splunk-Search/Creating-new-fields-and-setting-values-for-fields-retrieved-on/m-p/100101#M25876 <P>splunk_server is a reserved field used by Splunk. You should choose non-reserved field names. </P> <P>You can confirm this by searching any event that does not contain your splunk_server key=value and see that the field exists in every event.</P> Tue, 26 Jan 2016 17:40:18 GMT https://community.splunk.com/t5/Splunk-Search/Creating-new-fields-and-setting-values-for-fields-retrieved-on/m-p/100101#M25876 the_wolverine 2016-01-26T17:40:18Z https://community.splunk.com/t5/Splunk-Search/Creating-new-fields-and-setting-values-for-fields-retrieved-on/m-p/100102#M25877 <P>Here is a list of splunk default fields you might want to get acquainted with.</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.3.2/Knowledge/Usedefaultfields">http://docs.splunk.com/Documentation/Splunk/6.3.2/Knowledge/Usedefaultfields</A></P> Tue, 26 Jan 2016 17:46:33 GMT https://community.splunk.com/t5/Splunk-Search/Creating-new-fields-and-setting-values-for-fields-retrieved-on/m-p/100102#M25877 ben_leung 2016-01-26T17:46:33Z