Skip to main content
Question

Adding Splunk Metadata to events

  • March 11, 2025
  • 2 replies
  • 166 views
T

I have an Event with no Splunk Metadata value within the events and i am trying to add new fields such as host, index,source and sourcetype . custom fields and i tried using an eval but no luck, how do i go about this ?

    2 replies

    R
    • Ralph No.
    • Participating Frequently
    • March 11, 2025

    Hi @Tike Awe ,

    What did you try so far?

    Usually you would just add an Eval Function to a Pipeline and eval e.g.:
    index → 'yourindexname'

    Values need to be single quoted.

    This would end up as a new field to the root of the event and as indexed field in Splunk.

    P
    • Paul Dott
    • Known Participant
    • March 11, 2025

    You can also set metadata within the Source itself under "Fields". This can be handy if the source events are all going to the same place since you can set and forget.

    Terms & ConditionsAccessibility statement