Setting field values whenever adding events to splunk.

[misteryuku]

Since fields in Splunk are generally not set at index-time, except for a few key values like source, sourcetype, _raw and index.
Lets say i extracted other fields at search time and set the values for the fields and then send back to Splunk. I realised that i cannot set the values for linecount, index , splunk_server etc while i can set the other fields when i want to add events to Splunk server. That means the values for linecount, index, splunk_server fields values cannot be set although i retrieve those fields at search time. Is that true?

[Ayn]

How you retrieve the events originally has nothing to do with what Splunk does with incoming data. The values of the fields you mention can be overridden by search-time field extractions, but it sounds like a bad idea to touch them.

[sowings]

Yes, the name of the indexer would be its hostname. Because the splunk_server field is set when the data is indexed, I'm not sure that you can override it.

[misteryuku]

Hello sowings, what you mean by the name of the indexer? Is it the name of the indexer that indexes the data? How to format the log message to set the splunk_server field? Is it by key=value pairs??

[sowings]

In my experience, the "splunk_server" field contains the name of the indexer, though it could be the name of the search head--I don't currently have a distributed search environment in which to test.