Getting Data In

How to create a new field with static value during index time

DataOrg
Builder

I want to append new field with static value to the data during index time.

how to create with props.conf/transform.conf and no field extraction is required

0 Karma

richgalloway
SplunkTrust
SplunkTrust

You can use INGEST_EVAL = foo="bar" in transforms.conf.

---
If this reply helps you, Karma would be appreciated.

DataOrg
Builder

worked directly adding on inputs.conf.

[script://path/your_script.py]
_meta = script_name::abc.py

0 Karma

adonio
Ultra Champion

why do you need to do this? what is the use case?
if you need that data all the time ... you can add ... | eval NEW_FIELD = "YOUR STATIC VALUE" ...

0 Karma
Get Updates on the Splunk Community!

Get Operational Insights Quickly with Natural Language on the Splunk Platform

In today’s fast-paced digital world, turning data into actionable insights is essential for success. With ...

Stay Connected: Your Guide to August Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Unleash the Power of Splunk MCP and AI, Meet Us at .Conf 2025, and Find Even More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...