Creating new fields and setting values for fields retrieved on search.

[misteryuku]

I put the key value pairs of the log message into the content body whenever i create new events throught the splunk's receiver endpoint, so that i can see new fields being added.

hater = yes, nothater = suck, splunk_server=L33603

splunk_server field was retrieved during serach and i set the value to it. When i sent the data for indexing, the new fields are created but the value of the splunk_server field wasn't the value that i set.

[ben_leung]

Here is a list of splunk default fields you might want to get acquainted with.

http://docs.splunk.com/Documentation/Splunk/6.3.2/Knowledge/Usedefaultfields

[the_wolverine]

splunk_server is a reserved field used by Splunk. You should choose non-reserved field names.

You can confirm this by searching any event that does not contain your splunk_server key=value and see that the field exists in every event.