Getting Data In

Add a field to a sourcetype with a static value


I wanted to add a field to a specific sourcetype


nocmessage="ignore this server"

Seemed easy enough

EVAL-nocmessage="ignore this server"

But doesn't seem to work. If I toss that same message into a if statement it how ever does work. Is there a trick to this?


Turns out I was being too impatient waiting for the search head cluster to sync.



What are the permissions on the calculated field that you created? Is it visible in only one app, or is it global, etc?

0 Karma

Revered Legend

Where do you add this to props.conf ? I hope it's search head and you restarted your splunk instance after the change.

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!