Knowledge Management

How to save new field, which created with |cefkv command?

Shyngys_Bolatbe
Engager

How to save new field, which created with |cefkv command?
When I don't use |cefkv command my new fileds disappear.
I want to save fields in index with events

0 Karma

IgorB
Path Finder

New (1.5.0+) versions of CEF Extraction Add-on for Splunk have transforms that can be used to extract custom CEF fields without | cefkv
command

0 Karma

HiroshiSatoh
Champion

It is one of the benefits of Splunk to apply field definitions at search time.
If you really need it, you can also use the collect command to save the search results in the summary index.
You can also define fields if you do not want to use the cefkv command.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...