Getting Data In

Add a field to a sourcetype with a static value

daniel333
Builder

I wanted to add a field to a specific sourcetype

basically

nocmessage="ignore this server"

Seemed easy enough
props.conf

EVAL-nocmessage="ignore this server"

But doesn't seem to work. If I toss that same message into a if statement it how ever does work. Is there a trick to this?

daniel333
Builder

Turns out I was being too impatient waiting for the search head cluster to sync.

😞

lguinn2
Legend

What are the permissions on the calculated field that you created? Is it visible in only one app, or is it global, etc?

0 Karma

somesoni2
Revered Legend

Where do you add this to props.conf ? I hope it's search head and you restarted your splunk instance after the change.

0 Karma
Get Updates on the Splunk Community!

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...

4 Ways the Splunk Community Helps You Prepare for .conf25

.conf25 is right around the corner, and whether you’re a first-time attendee or a seasoned Splunker, the ...