Splunk Search

Setting field values whenever adding events to splunk.

Communicator

Since fields in Splunk are generally not set at index-time, except for a few key values like source, sourcetype, raw and index.
Lets say i extracted other fields at search time and set the values for the fields and then send back to Splunk. I realised that i cannot set the values for linecount, index , splunk
server etc while i can set the other fields when i want to add events to Splunk server. That means the values for linecount, index, splunk_server fields values cannot be set although i retrieve those fields at search time. Is that true?

Tags (2)
0 Karma

Legend

How you retrieve the events originally has nothing to do with what Splunk does with incoming data. The values of the fields you mention can be overridden by search-time field extractions, but it sounds like a bad idea to touch them.

Splunk Employee
Splunk Employee

Yes, the name of the indexer would be its hostname. Because the splunk_server field is set when the data is indexed, I'm not sure that you can override it.

0 Karma

Communicator

Hello sowings, what you mean by the name of the indexer? Is it the name of the indexer that indexes the data? How to format the log message to set the splunk_server field? Is it by key=value pairs??

0 Karma

Splunk Employee
Splunk Employee

In my experience, the "splunk_server" field contains the name of the indexer, though it could be the name of the search head--I don't currently have a distributed search environment in which to test.

0 Karma