Related Answers
Splunk Enterprise version 7.0 is no longer supported as of October 23, 2019. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see How to upgrade Splunk Enterprise.
Download topic as PDF
Create calculated fields with Splunk Web
Create a calculated field with Splunk Web. Use calculated fields as a shortcut for performing repetitive, long, or complex transformations using the eval command.
Prerequisites
- Review About calculated fields.
Creating a new calculated field in settings
- Select Settings > Fields.
- Select Calculated Fields > New.
- Select the app that will use the calculated field.
- Select host, source, or sourcetype to apply to the calculated field and specify a name.
- You can also enter a wildcard if you want to apply this for all hosts, sources, or sourcetypes.
- Name the resultant calculated field.
- Define the eval expression.
Last modified on 07 August, 2019
|
PREVIOUS About calculated fields |
NEXT Configure calculated fields with props.conf |
This documentation applies to the following versions of Splunk® Enterprise: 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.0.13, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.1.9, 7.1.10, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.10, 7.2.8, 7.2.9, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 7.3.5, 8.0.0, 8.0.1, 7.2.7, 8.0.2, 8.0.3
Feedback submitted, thanks!