Getting Data In

How to add field with random value at index time

Micmac
Path Finder

Hello,

I have a quick question :

There is a way at index time to add a field witch could represent something like an event_id ?

Something like this :

FORMAT = event_id::<any_random_value>

At this time I don't know how to generate a unique value to replace

Thanks,

Tags (2)
0 Karma
1 Solution

Ayn
Legend

No. If you're after getting unique id's for events, you could have a look at the _cd field which contains a bucket ID and an address within that bucket. A combination of index and _cd will be unique.

View solution in original post

Ayn
Legend

No. If you're after getting unique id's for events, you could have a look at the _cd field which contains a bucket ID and an address within that bucket. A combination of index and _cd will be unique.

Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...