Create calculated fields with Splunk Web
Create a calculated field with Splunk Web. Use calculated fields as a shortcut for performing repetitive, long, or complex transformations using the eval command.
- Review About calculated fields for more information about calculated fields.
Creating a new calculated field in settings
- Select Settings > Fields.
- Select Calculated Fields > New.
- Select the app that will use the calculated field.
- Select host, source, or sourcetype to apply to the calculated field and specify a name.
- Name the calculated field.
- Define the eval expression.
About calculated fields
Configure calculated fields with props.conf
This documentation applies to the following versions of Splunk Cloud™: 6.6.3