Splunk Search

Custom Fields at index Time

adityapavan18
Contributor

Hi

I know that splunk automatically creates default fields like host,sourcetype,index at index time.And also the splunk provides a option to create any new fields also during index time.

My requirement is that a new field needs to be added at indextime called Component.
Its a constant value based on host and is not available in the eventlogs. Can anyone please suggest the way to do this

Tags (2)
0 Karma
1 Solution

Ayn
Legend

Something like this. props.conf:

[your_sourcetype_here]
TRANSFORMS-addcomponent = addcomponent

transforms.conf:

[addcomponent]
SOURCE_KEY = MetaData:Host
REGEX = replace_with_your_host_here
FORMAT = component::your_value_here
WRITE_META = true

I haven't tried this out (I've no Splunk instance to test it on at the moment) but hopefully you get the general idea.

View solution in original post

Ayn
Legend

Something like this. props.conf:

[your_sourcetype_here]
TRANSFORMS-addcomponent = addcomponent

transforms.conf:

[addcomponent]
SOURCE_KEY = MetaData:Host
REGEX = replace_with_your_host_here
FORMAT = component::your_value_here
WRITE_META = true

I haven't tried this out (I've no Splunk instance to test it on at the moment) but hopefully you get the general idea.

adityapavan18
Contributor

Thnx a lot. Tried it and that worked

0 Karma
Get Updates on the Splunk Community!

Message Parsing in SOCK

Introduction This blog post is part of an ongoing series on SOCK enablement. In this blog post, I will write ...

Exploring the OpenTelemetry Collector’s Kubernetes annotation-based discovery

We’ve already explored a few topics around observability in a Kubernetes environment -- Common Failures in a ...

Use ‘em or lose ‘em | Splunk training units do expire

Whether it’s hummus, a ham sandwich, or a human, almost everything in this world has an expiration date. And, ...