Hi All,
Thanks upfront for your time.
I have a task that I am trying to create 2 fields for any sourcetype that visits my Heavy Forwarders on the way to my indexer cluster.
I had created following props.conf at HF to assign values as below and failed :
[mycustomlogg]
EVAL-HF_LVL1_NAME = myservername
EVAL-HF_LVL1_TIME = now()
This might be good question for any admin who wants to have more detail on data travel times within Splunk environment even though it might be prone to lesser performance if succeeded.
Are there anybody who had achieved similar in the past ? I believe I should be able to assign HF_LVL1_NAME with transforms.conf. However, still have no clue for now() function within conf files.
↧