https://community.splunk.com/t5/Splunk-Search/How-To-Generate-A-Fixed-Eval-Field/m-p/172249#M49363 <P>You can define calculated fields as mentioned in the link below. Whatever you put in EVAL can be used here.</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.2.0/Knowledge/definecalcfields">http://docs.splunk.com/Documentation/Splunk/6.2.0/Knowledge/definecalcfields</A></P> Tue, 10 Mar 2015 16:29:17 GMT somesoni2 2015-03-10T16:29:17Z https://community.splunk.com/t5/Splunk-Search/How-To-Generate-A-Fixed-Eval-Field/m-p/172247#M49361 <P>I have a field in search time :</P> <PRE><CODE>| eval Volume = (QuantityA + QuantityB) </CODE></PRE> <P>How can I let this automatic, so I can just use Volume instead of creating this eval field for each query.</P> Tue, 10 Mar 2015 15:29:13 GMT https://community.splunk.com/t5/Splunk-Search/How-To-Generate-A-Fixed-Eval-Field/m-p/172247#M49361 vtsguerrero 2015-03-10T15:29:13Z https://community.splunk.com/t5/Splunk-Search/How-To-Generate-A-Fixed-Eval-Field/m-p/172248#M49362 <P>You should be able to do this in your conf files, transforms.conf and fields.conf and props.conf</P> <P>Take a look here, looks like somebody's already answered that question;<BR /> <A href="http://answers.splunk.com/answers/39405/adding-static-field-value-using-props-transforms-based-on-source.html">http://answers.splunk.com/answers/39405/adding-static-field-value-using-props-transforms-based-on-source.html</A></P> Tue, 10 Mar 2015 15:49:34 GMT https://community.splunk.com/t5/Splunk-Search/How-To-Generate-A-Fixed-Eval-Field/m-p/172248#M49362 markthompson 2015-03-10T15:49:34Z https://community.splunk.com/t5/Splunk-Search/How-To-Generate-A-Fixed-Eval-Field/m-p/172249#M49363 <P>You can define calculated fields as mentioned in the link below. Whatever you put in EVAL can be used here.</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.2.0/Knowledge/definecalcfields">http://docs.splunk.com/Documentation/Splunk/6.2.0/Knowledge/definecalcfields</A></P> Tue, 10 Mar 2015 16:29:17 GMT https://community.splunk.com/t5/Splunk-Search/How-To-Generate-A-Fixed-Eval-Field/m-p/172249#M49363 somesoni2 2015-03-10T16:29:17Z