Append field to event data

[rantravee]

hello,

Using a custom script input I can obtain some data from a particular network resource. I would like to know if is possible to inject/append a field to the generated event indexed by splunk , so that I can augment my knowledge about each event.

Thanks

[rroberts]

One approach would be to leverage lookups. Checkout: http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Addfieldsfromexternaldatasources?r=sear...

You can create field=value pairs on the the fly to augment knowledge about your events.

[rantravee]

Interesting, but there seems to be a limitation.

If I understood correctly, one can create new fields/values , but they must be somehow related to the event through an field that is already contained by the event.

I need to add/inject a field=value pair to my event , that is completely unrelated to any of it's fields.

And I need to do it on the fly . Is there any possibility to allow me to do this