Archive

how to create field store permanently

tailesley
New Member

HI,

I try to define a field name using the below statement in the search column, however I do not get this filed store permanently and display in the Field section after I refresh the screen,

Here is the command im using to create new field to total up the existing 2 numeric field:
| eval TotalBytes=Bytes_Received+Bytes_Sent

I have to issue the same statement above in the search in order to get this field display on the screen again. Any idea how to store this permanently? Thank you.

Tags (1)
0 Karma

araitz
Splunk Employee
Splunk Employee

Please read the documentation here:

http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Addfieldsatsearchtime#Use_Splunk_Manage...

You can use configuration files (props/transforms.conf) or use Manager > Fields via Splunk Web.

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!