New metadata field for all events coming via UF for custom application

[Charlize]

Added the config for the new metadata field in the inputs.conf file and created a fields.conf file to set the field as indexed=true. Still the field is not showing up on SH. This is done for the cloud envi

inputs.conf
[monitor://D:\Splunk\abc\*.csv]

disabled = false

index = index_abc

sourcetype = src_abc

_meta = id::123

fields.conf

[id]

INDEXED=true

[PickleRick]

Adding to valid @livehybrid points, you should set INDEXED_VALUE=false. It has nothing to do with the issue at hand but without it you won't be able to search for id=123 if then"123" string isn't contained within the raw event.

[livehybrid]

Hi @Charlize 

Just to check, did you deploy the fields.conf to your cloud environment, not the UF?

Also, are you able to search the field with tstats, such as
| tstats count where index=index_abc by id

🌟Did this answer help you? If so, please consider:

• Adding karma to show it was useful

• Marking it as the solution if it resolved your issue

• Commenting if you need any clarificatiob

Your feedback encourages the volunteers in this community to continue contributing.

[Charlize]

| tstats count where index=index_abc by id   

There are no results for this query. But events are there in the index.

[PickleRick]

1. Again - where did you put the fields.conf? (but this shouldn't affect tstats)

2. Do you have any other _meta definitions on your UF. Did you verify the effective config with btool?

3. Try 

| walklex index=index_abc type=field

over a longer time span and see if you get your id  as one of the results.