Splunk Search

how to add a field like "host, source, sourcetype"?

facefaces
New Member

hi,everyone
when i use sdk for python,I found that function:submit can only use "host , source, sourcetype".
i want to add a field to store some information just like filename or filepath,i want to Use these fields to count information
what should i do

Tags (3)
0 Karma

micahkemp
Champion

The fields index, host, source, and sourcetype are the only fields that it is appropriate to have your input define. This is true no matter the type of input (modular, scripted, monitor, etc). The other default indexed fields (_time, punct) are calculated by Splunk at index time.

If you want other indexed fields, you would have to add the configuration to Splunk to determine the values of these fields at index time. However, you almost certainly don't need to do this, and should instead make use of Splunk's search-time capabilities to parse your data.

Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...