Getting Data In

How to add field with random value at index time

Micmac
Path Finder

Hello,

I have a quick question :

There is a way at index time to add a field witch could represent something like an event_id ?

Something like this :

FORMAT = event_id::<any_random_value>

At this time I don't know how to generate a unique value to replace

Thanks,

Tags (2)
0 Karma
1 Solution

Ayn
Legend

No. If you're after getting unique id's for events, you could have a look at the _cd field which contains a bucket ID and an address within that bucket. A combination of index and _cd will be unique.

View solution in original post

Ayn
Legend

No. If you're after getting unique id's for events, you could have a look at the _cd field which contains a bucket ID and an address within that bucket. A combination of index and _cd will be unique.

Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...