Splunk Search

How to add custom field to event?

mnoster
Engager

I want to add custom fields to specific index and have them log accordingly.

Currently there are only a few default fields such as "host", "index", "sourcetype", etc...

Not sure if this is the best place to add additional data or not.

How can I add more fields?

alt text

0 Karma

woodcock
Esteemed Legend
0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...

Major Splunk Upgrade – Prepare your Environment for Splunk 10 Now!

Attention App Developers: Test Your Apps with the Splunk 10.0 Beta and Ensure Compatibility Before the ...

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...