Is there a way to append fields at the UF ?

[daniel333]

All,

Is there a way for me to append data to an event at the UF level ? Or perhaps at index time ? I want to prepopulate some business details. I was also asked recently to autoappend geoip info into the events if possible.

Any ideas?

[DalJeanis]

There are lots of things you CAN do, but you need to focus on what you SHOULD do.

For instance, you can add automatic geoip lookup at search time, and that's fine... but you probably don't want the results being pre-inserted into the data. Same for business details.

There are WAY too many things that could go wrong, not to mention ballooning the costs of licensing and storage for no good reason.

Look into automatic lookups, that's probably where you need to focus.

https://docs.splunk.com/Documentation/SplunkCloud/6.6.1/Knowledge/DefineanautomaticlookupinSplunkWeb

There MIGHT be a use case for certain applications where you constantly need to access the data primarily in a specific way, based on a lookup relationship that is volatile and that must be constantly updated over time. In that specific case, it MIGHT be valid to insert the data. MIGHT. But time-based lookups might be better for some of those use cases as well.