You can define calculated fields as mentioned in the link below. Whatever you put in EVAL can be used here.
http://docs.splunk.com/Documentation/Splunk/6.2.0/Knowledge/definecalcfields
You can define calculated fields as mentioned in the link below. Whatever you put in EVAL can be used here.
http://docs.splunk.com/Documentation/Splunk/6.2.0/Knowledge/definecalcfields
You should be able to do this in your conf files, transforms.conf and fields.conf and props.conf
Take a look here, looks like somebody's already answered that question;
http://answers.splunk.com/answers/39405/adding-static-field-value-using-props-transforms-based-on-so...