how to create field store permanently

[tailesley]

HI,

I try to define a field name using the below statement in the search column, however I do not get this filed store permanently and display in the Field section after I refresh the screen,

Here is the command im using to create new field to total up the existing 2 numeric field:
| eval TotalBytes=Bytes_Received+Bytes_Sent

I have to issue the same statement above in the search in order to get this field display on the screen again. Any idea how to store this permanently? Thank you.

[araitz]

Please read the documentation here:

http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Addfieldsatsearchtime#Use_Splunk_Manage...

You can use configuration files (props/transforms.conf) or use Manager > Fields via Splunk Web.