- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How to add custom field to Splunk ES Asset dataset
hpwang1014
New Member
06-11-2020
06:32 AM
I am new to Splunk and have a question about Asset and Identity data modle. We are on ES 5.3.0. I am trying to load data into Asset and Identify model, need to add some custom fields in addtion to the default fields. I tried to add to the main asset fields, also tried to add to the calculated fields. But when I run |`assets`, it des not show the custom fields I added. Any ideas? Also I did not find in the 5.3.0 document on how to add the custom fields. Only see it in 6.1.1 ES document.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

richgalloway

SplunkTrust
06-11-2020
07:25 AM
Support for custom asset fields didn't start until ES 6.0.
---
If this reply helps you, Karma would be appreciated.
If this reply helps you, Karma would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
hpwang1014
New Member
06-11-2020
07:30 AM
Thank you, richgalloway! Looks like we need to upgrade.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

richgalloway

SplunkTrust
06-11-2020
09:39 AM
If your problem is resolved, then please click the "Accept as Solution" button to help future readers.
---
If this reply helps you, Karma would be appreciated.
If this reply helps you, Karma would be appreciated.
