Splunk Search

how to add a field like "host, source, sourcetype"?

facefaces
New Member

hi,everyone
when i use sdk for python,I found that function:submit can only use "host , source, sourcetype".
i want to add a field to store some information just like filename or filepath,i want to Use these fields to count information
what should i do

Tags (3)
0 Karma

micahkemp
Champion

The fields index, host, source, and sourcetype are the only fields that it is appropriate to have your input define. This is true no matter the type of input (modular, scripted, monitor, etc). The other default indexed fields (_time, punct) are calculated by Splunk at index time.

If you want other indexed fields, you would have to add the configuration to Splunk to determine the values of these fields at index time. However, you almost certainly don't need to do this, and should instead make use of Splunk's search-time capabilities to parse your data.

Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...