Dashboards & Visualizations

how can I make sure a given field is available for a given source type?

mcbradford
Contributor

I am using the following within a search to create a field called link.

eval link=uri_scheme+"://"+dest_host+uri_path

I really just want the field to be an available field for the sourcetype. Is this possible, and if yes how?

Tags (2)
0 Karma

martin_mueller
SplunkTrust
SplunkTrust
0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.