- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi
I know that splunk automatically creates default fields like host,sourcetype,index at index time.And also the splunk provides a option to create any new fields also during index time.
My requirement is that a new field needs to be added at indextime called Component.
Its a constant value based on host and is not available in the eventlogs. Can anyone please suggest the way to do this
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Something like this. props.conf:
[your_sourcetype_here]
TRANSFORMS-addcomponent = addcomponent
transforms.conf:
[addcomponent]
SOURCE_KEY = MetaData:Host
REGEX = replace_with_your_host_here
FORMAT = component::your_value_here
WRITE_META = true
I haven't tried this out (I've no Splunk instance to test it on at the moment) but hopefully you get the general idea.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Something like this. props.conf:
[your_sourcetype_here]
TRANSFORMS-addcomponent = addcomponent
transforms.conf:
[addcomponent]
SOURCE_KEY = MetaData:Host
REGEX = replace_with_your_host_here
FORMAT = component::your_value_here
WRITE_META = true
I haven't tried this out (I've no Splunk instance to test it on at the moment) but hopefully you get the general idea.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thnx a lot. Tried it and that worked
