Splunk Search

how to create field store permanently

tailesley
New Member

HI,

I try to define a field name using the below statement in the search column, however I do not get this filed store permanently and display in the Field section after I refresh the screen,

Here is the command im using to create new field to total up the existing 2 numeric field:
| eval TotalBytes=Bytes_Received+Bytes_Sent

I have to issue the same statement above in the search in order to get this field display on the screen again. Any idea how to store this permanently? Thank you.

Tags (1)
0 Karma

araitz
Splunk Employee
Splunk Employee

Please read the documentation here:

http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Addfieldsatsearchtime#Use_Splunk_Manage...

You can use configuration files (props/transforms.conf) or use Manager > Fields via Splunk Web.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...