HI,
I try to define a field name using the below statement in the search column, however I do not get this filed store permanently and display in the Field section after I refresh the screen,
Here is the command im using to create new field to total up the existing 2 numeric field:
| eval TotalBytes=Bytes_Received+Bytes_Sent
I have to issue the same statement above in the search in order to get this field display on the screen again. Any idea how to store this permanently? Thank you.
Please read the documentation here:
You can use configuration files (props/transforms.conf) or use Manager > Fields via Splunk Web.