Related Answers
Download topic as PDF
Create calculated fields with Splunk Web
Create a calculated field with Splunk Web. Use calculated fields as a shortcut for performing repetitive, long, or complex transformations using the eval command.
Prerequisites
- Review About calculated fields.
Steps
- Select Settings > Fields.
- On the row for Calculated Fields, click Add new.
- Select the Destination app that will use the calculated field.
- Select a host, source, or source type to apply to the calculated field. Provide the name of the host, source, or source type.
You can also enter a wildcard if you want to apply this for all hosts, sources, or source types. - Name the resultant calculated field.
- Provide the eval expression used by the calculated field,
The knowledge object will be private to you when you first create it, meaning that other users cannot see it or use it. For other users to be able to use it, it must be shared to an app, or shared globally. For more information see Manage knowledge object permissions.
|
PREVIOUS About calculated fields |
NEXT Configure calculated fields with props.conf |
This documentation applies to the following versions of Splunk® Enterprise: 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.0.13, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.1.9, 7.1.10, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.2.10, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 7.3.5, 7.3.6, 7.3.7, 7.3.9, 8.0.0, 8.0.1, 8.0.2, 8.0.3, 8.0.4, 8.0.5, 8.0.6, 8.0.7, 8.0.8, 8.0.9, 8.1.0, 8.1.1, 7.3.8, 8.1.2, 8.1.3
Feedback submitted, thanks!