Creating field value pair

[splunkingsplun1]

According to the documentation here I need to have ids_type in my events as follows ids_type="network" or ids_type="application" or ids_type="host". How can I add a field value pair to my events automatically? Would I have to create this in transforms.conf?

[netdefender]
REGEX =  Netdefender
FORMAT = ids_type=network
WRITE_META = true

This is a portion of a sample event:

Jan 30 10:32:43 192.168.1.1 Netdefender: 30-01-2014 02:54:05 WARNING

I am not sure how this works its been a long day. Help please!

[somesoni2 · Accepted solution]

If you want to add an additional field for each sourcetype you can use calculated fields.

e.g.
props.conf (assuming 'netdefender' is your sourcetype name)

[netdefender]
pulldown_type = 1
EVAL-ids_type = "network"

This will add a field ids_type="network" for all the logs in sourcetype "netdefender"

[splunkingsplun1]

This worked just make sure to use quotes

[asimagu]

first of all you would need to specify something to extract in the regex, could we see some sample code in order to help you?