Getting Data In

How to assign/create indexed field in Splunk?

SplunkDash
Motivator

Hello,

I have huge volume of data coming in under different source types (or indexes) for different applications/projects. Are there any ways we can assign any indexed fields for each of the data sources/indexes/apps? As an example, most of the cases ACCOUNTID and IPAddress are the unique fields for each of the applications/Projects. How would I assign these 2 fields as indexed fields? Any thoughts or recommendations would be highly appreciated. Thank you so much.

Labels (3)
Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Create a props.conf file (put it in your org's custom app) with a stanza for each sourcetype.  In each stanza, put TRANSFORM setting that indexes the desired field.  You'll need a matching stanza in transforms.conf that uses FORMAT or INGEST_EVAL to index the field.

---
If this reply helps you, Karma would be appreciated.
0 Karma

SplunkDash
Motivator

Hello,

Using this recommended transforms.conf to have the indexed field is going to be an indexed time field extraction?  Thank you so much again!

 

0 Karma

SplunkDash
Motivator

Hello,

Thank you so much for your quick response. Are there any other ways instead of using Transforms.conf file, as typically, we don't use transforms.conf file in our UFs/HFs push. Thank you so much.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I know of no other ways.

Transforms cannot be used in a UF.  They can only be used in HF and indexer.

---
If this reply helps you, Karma would be appreciated.

SplunkDash
Motivator

Hello,

Thank you so much for your quick response., truly appreciate it. 

The main reason we wanted to use indexed fields is to optimize the search/base search. But, using indexed field and indexed time field extraction may cause some performance issues. We have huge volume of data and a several source types/indexes with unique ACCOUNTID and IPAddress fields, do you have any recommendation how to optimize the base search (search) in real time as we require to search over a wide range/period of time. Thank you so much, any recommendations will be helpful and greatly appreciated.

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...