Archive

Custom Fields at index Time

adityapavan18
Contributor

Hi

I know that splunk automatically creates default fields like host,sourcetype,index at index time.And also the splunk provides a option to create any new fields also during index time.

My requirement is that a new field needs to be added at indextime called Component.
Its a constant value based on host and is not available in the eventlogs. Can anyone please suggest the way to do this

Tags (2)
0 Karma
1 Solution

Ayn
Legend

Something like this. props.conf:

[your_sourcetype_here]
TRANSFORMS-addcomponent = addcomponent

transforms.conf:

[addcomponent]
SOURCE_KEY = MetaData:Host
REGEX = replace_with_your_host_here
FORMAT = component::your_value_here
WRITE_META = true

I haven't tried this out (I've no Splunk instance to test it on at the moment) but hopefully you get the general idea.

View solution in original post

Ayn
Legend

Something like this. props.conf:

[your_sourcetype_here]
TRANSFORMS-addcomponent = addcomponent

transforms.conf:

[addcomponent]
SOURCE_KEY = MetaData:Host
REGEX = replace_with_your_host_here
FORMAT = component::your_value_here
WRITE_META = true

I haven't tried this out (I've no Splunk instance to test it on at the moment) but hopefully you get the general idea.

View solution in original post

adityapavan18
Contributor

Thnx a lot. Tried it and that worked

0 Karma