Splunk Search

how to add a field like "host, source, sourcetype"?

facefaces
New Member

hi,everyone
when i use sdk for python,I found that function:submit can only use "host , source, sourcetype".
i want to add a field to store some information just like filename or filepath,i want to Use these fields to count information
what should i do

Tags (3)
0 Karma

micahkemp
Champion

The fields index, host, source, and sourcetype are the only fields that it is appropriate to have your input define. This is true no matter the type of input (modular, scripted, monitor, etc). The other default indexed fields (_time, punct) are calculated by Splunk at index time.

If you want other indexed fields, you would have to add the configuration to Splunk to determine the values of these fields at index time. However, you almost certainly don't need to do this, and should instead make use of Splunk's search-time capabilities to parse your data.

Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...