Getting Data In

How to assign/create indexed field in Splunk?

SplunkDash
Motivator

Hello,

I have huge volume of data coming in under different source types (or indexes) for different applications/projects. Are there any ways we can assign any indexed fields for each of the data sources/indexes/apps? As an example, most of the cases ACCOUNTID and IPAddress are the unique fields for each of the applications/Projects. How would I assign these 2 fields as indexed fields? Any thoughts or recommendations would be highly appreciated. Thank you so much.

Labels (3)
Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Create a props.conf file (put it in your org's custom app) with a stanza for each sourcetype.  In each stanza, put TRANSFORM setting that indexes the desired field.  You'll need a matching stanza in transforms.conf that uses FORMAT or INGEST_EVAL to index the field.

---
If this reply helps you, Karma would be appreciated.
0 Karma

SplunkDash
Motivator

Hello,

Using this recommended transforms.conf to have the indexed field is going to be an indexed time field extraction?  Thank you so much again!

 

0 Karma

SplunkDash
Motivator

Hello,

Thank you so much for your quick response. Are there any other ways instead of using Transforms.conf file, as typically, we don't use transforms.conf file in our UFs/HFs push. Thank you so much.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I know of no other ways.

Transforms cannot be used in a UF.  They can only be used in HF and indexer.

---
If this reply helps you, Karma would be appreciated.

SplunkDash
Motivator

Hello,

Thank you so much for your quick response., truly appreciate it. 

The main reason we wanted to use indexed fields is to optimize the search/base search. But, using indexed field and indexed time field extraction may cause some performance issues. We have huge volume of data and a several source types/indexes with unique ACCOUNTID and IPAddress fields, do you have any recommendation how to optimize the base search (search) in real time as we require to search over a wide range/period of time. Thank you so much, any recommendations will be helpful and greatly appreciated.

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...