Splunk Search

how to add a field like "host, source, sourcetype"?

facefaces
New Member

hi,everyone
when i use sdk for python,I found that function:submit can only use "host , source, sourcetype".
i want to add a field to store some information just like filename or filepath,i want to Use these fields to count information
what should i do

Tags (3)
0 Karma

micahkemp
Champion

The fields index, host, source, and sourcetype are the only fields that it is appropriate to have your input define. This is true no matter the type of input (modular, scripted, monitor, etc). The other default indexed fields (_time, punct) are calculated by Splunk at index time.

If you want other indexed fields, you would have to add the configuration to Splunk to determine the values of these fields at index time. However, you almost certainly don't need to do this, and should instead make use of Splunk's search-time capabilities to parse your data.

Get Updates on the Splunk Community!

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...

Splunk MCP & Agentic AI: Machine Data Without Limits

Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization uses ...