topic Re: Setting field values whenever adding events to splunk. in Splunk Search

Setting field values whenever adding events to splunk.

misteryuku — Mon, 28 Sep 2020 11:34:34 GMT

Since fields in Splunk are generally not set at index-time, except for a few key values like source, sourcetype, _raw and index.
Lets say i extracted other fields at search time and set the values for the fields and then send back to Splunk. I realised that i cannot set the values for linecount, index , splunk_server etc while i can set the other fields when i want to add events to Splunk server. That means the values for linecount, index, splunk_server fields values cannot be set although i retrieve those fields at search time. Is that true?

Re: Setting field values whenever adding events to splunk.

Ayn — Mon, 26 Mar 2012 08:50:31 GMT

How you retrieve the events originally has nothing to do with what Splunk does with incoming data. The values of the fields you mention can be overridden by search-time field extractions, but it sounds like a bad idea to touch them.

Re: Setting field values whenever adding events to splunk.

sowings — Mon, 26 Mar 2012 14:52:51 GMT

In my experience, the "splunk_server" field contains the name of the indexer, though it could be the name of the search head--I don't currently have a distributed search environment in which to test.

Re: Setting field values whenever adding events to splunk.

misteryuku — Tue, 27 Mar 2012 04:55:45 GMT

Hello sowings, what you mean by the name of the indexer? Is it the name of the indexer that indexes the data? How to format the log message to set the splunk_server field? Is it by key=value pairs??

Re: Setting field values whenever adding events to splunk.

sowings — Tue, 27 Mar 2012 17:49:34 GMT

Yes, the name of the indexer would be its hostname. Because the splunk_server field is set when the data is indexed, I'm not sure that you can override it.