Splunk Search

Setting field values whenever adding events to splunk.

misteryuku
Communicator

Since fields in Splunk are generally not set at index-time, except for a few key values like source, sourcetype, _raw and index.
Lets say i extracted other fields at search time and set the values for the fields and then send back to Splunk. I realised that i cannot set the values for linecount, index , splunk_server etc while i can set the other fields when i want to add events to Splunk server. That means the values for linecount, index, splunk_server fields values cannot be set although i retrieve those fields at search time. Is that true?

Tags (2)
0 Karma

Ayn
Legend

How you retrieve the events originally has nothing to do with what Splunk does with incoming data. The values of the fields you mention can be overridden by search-time field extractions, but it sounds like a bad idea to touch them.

sowings
Splunk Employee
Splunk Employee

Yes, the name of the indexer would be its hostname. Because the splunk_server field is set when the data is indexed, I'm not sure that you can override it.

0 Karma

misteryuku
Communicator

Hello sowings, what you mean by the name of the indexer? Is it the name of the indexer that indexes the data? How to format the log message to set the splunk_server field? Is it by key=value pairs??

0 Karma

sowings
Splunk Employee
Splunk Employee

In my experience, the "splunk_server" field contains the name of the indexer, though it could be the name of the search head--I don't currently have a distributed search environment in which to test.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...