Are you a member of the Splunk Community?
- Find Answers
- :
- Splunk Administration
- :
- Admin Other
- :
- Knowledge Management
- :
- Creating field value pair
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
According to the documentation here I need to have ids_type in my events as follows ids_type="network" or ids_type="application" or ids_type="host". How can I add a field value pair to my events automatically? Would I have to create this in transforms.conf?
[netdefender]
REGEX = Netdefender
FORMAT = ids_type=network
WRITE_META = true
This is a portion of a sample event:
Jan 30 10:32:43 192.168.1.1 Netdefender: 30-01-2014 02:54:05 WARNING
I am not sure how this works its been a long day. Help please!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If you want to add an additional field for each sourcetype you can use calculated fields.
e.g.
props.conf (assuming 'netdefender' is your sourcetype name)
[netdefender]
pulldown_type = 1
EVAL-ids_type = "network"
This will add a field ids_type="network" for all the logs in sourcetype "netdefender"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If you want to add an additional field for each sourcetype you can use calculated fields.
e.g.
props.conf (assuming 'netdefender' is your sourcetype name)
[netdefender]
pulldown_type = 1
EVAL-ids_type = "network"
This will add a field ids_type="network" for all the logs in sourcetype "netdefender"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This worked just make sure to use quotes
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
first of all you would need to specify something to extract in the regex, could we see some sample code in order to help you?
Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps
What’s New in Splunk Observability – September 2025
Fun with Regular Expression - multiples of nine
