Splunk Search

Setting field values whenever adding events to splunk.

misteryuku
Communicator

Since fields in Splunk are generally not set at index-time, except for a few key values like source, sourcetype, _raw and index.
Lets say i extracted other fields at search time and set the values for the fields and then send back to Splunk. I realised that i cannot set the values for linecount, index , splunk_server etc while i can set the other fields when i want to add events to Splunk server. That means the values for linecount, index, splunk_server fields values cannot be set although i retrieve those fields at search time. Is that true?

Tags (2)
0 Karma

Ayn
Legend

How you retrieve the events originally has nothing to do with what Splunk does with incoming data. The values of the fields you mention can be overridden by search-time field extractions, but it sounds like a bad idea to touch them.

sowings
Splunk Employee
Splunk Employee

Yes, the name of the indexer would be its hostname. Because the splunk_server field is set when the data is indexed, I'm not sure that you can override it.

0 Karma

misteryuku
Communicator

Hello sowings, what you mean by the name of the indexer? Is it the name of the indexer that indexes the data? How to format the log message to set the splunk_server field? Is it by key=value pairs??

0 Karma

sowings
Splunk Employee
Splunk Employee

In my experience, the "splunk_server" field contains the name of the indexer, though it could be the name of the search head--I don't currently have a distributed search environment in which to test.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...