Knowledge Management

How to apply calculated fields depending on used index?

Path Finder

I have 5 different apps with different index on each apps and with same sourcetypes every apps. I have different calculated fields every apps that has only "per app" permission and my 6th app will be my main app that will search all my index. How will I apply my calculated fields on my 6th app when i make a query of different index. To explain more further, i will have this example...

App1: index=app1
App2: index=app2
App3: index=app3
App4: index=app4
App5: index=app5

On my 6th app, if I search "index=app1", I need the calculated fields that I make on App1. Is there any way to solve this kind of problem?

PS: I cannot make the permission of my calculated fields to Global because it will overlap to other apps because the sourcetype is same on all apps. Thanks 😃

0 Karma


Hi iancorrea,
you could try to create a calculated field for each app from the original field with a different name (e.g. my_field_app1) with global access properties.
Then you could use, in the sixth app, the new calculated fields, eventually renaming them, in your searches.


0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!