Getting Data In

Creating Index time fields for your HF's


I'm trying to follow guides on how to create a new indexed field. Basically creating a field that gives us the name of the hf the data came from: "Splunk_HF"

Im having a hard time understanding how to actually grab the heavy forwarders name. If this was a raw log i would attempt to do regex on the host based on where that name in we can within the log but here in drawing a blank. It's like I'm pulling the info from the air and I simply don't know the right syntax to make this happen

I'm sure plenty have done it his before and it should be similar for each of us. Can someone please stir me in the right direction with my configurations


This is my idea so far, can someone please correct my mistakes

DEST_KEY = MetaData:Host
REGEX = I have no idea
Format = host::$1

TRANSFORMS-extract = getting_splunk_forwarder

INDEXED = true


I really do appreciate splunk docs and generally people will post links for answers by themselves, but if someone could please show me the proper syntax in the stanza it will help me understand.

Labels (3)
0 Karma


A regex won't do since the name of the HF is not to be found in the data so it can't be extracted.  Consider using INGEST_EVAL to create the desired field.



INGEST_EVAL = Splunk_HF="foo"


 Unfortunately, I believe the value needs to be hard-coded since Splunk can't take advantage of environment variables.

BTW, resist the urge to put the HF name in the host field.  You'll find it less useful than you think and you'll lose the original host of the data.

If this reply helps you, an upvote would be appreciated.
0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!