Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

How to create a custom field at Heavy Forwarder for all sourcetypes ?

$
0
0
Hi All, Thanks upfront for your time. I have a task that I am trying to create 2 fields for any sourcetype that visits my Heavy Forwarders on the way to my indexer cluster. I had created following props.conf at HF to assign values as below and failed : [mycustomlogg] EVAL-HF_LVL1_NAME = myservername EVAL-HF_LVL1_TIME = now() This might be good question for any admin who wants to have more detail on data travel times within Splunk environment even though it might be prone to lesser performance if succeeded. Are there anybody who had achieved similar in the past ? I believe I should be able to assign HF_LVL1_NAME with transforms.conf. However, still have no clue for now() function within conf files.

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>