Splunk Cloud Platform

Knowledge Manager Manual

Acrobat logo Download manual as PDF

Acrobat logo Download topic as PDF

Create calculated fields with Splunk Web

Create a calculated field with Splunk Web. Use calculated fields as a shortcut for performing repetitive, long, or complex transformations using the eval command.



  1. Select Settings > Fields.
  2. On the row for Calculated Fields, click Add new.
  3. Select the Destination app that will use the calculated field.
  4. Select a host, source, or source type to apply to the calculated field. Provide the name of the host, source, or source type.
    You can also enter a wildcard if you want to apply this for all hosts, sources, or source types.
  5. Name the resultant calculated field.
  6. Provide the eval expression used by the calculated field,

The knowledge object will be private to you when you first create it, meaning that other users cannot see it or use it. For other users to be able to use it, it must be shared to an app, or shared globally. For more information see Manage knowledge object permissions.

Last modified on 07 August, 2020
About calculated fields
Configure calculated fields with props.conf

This documentation applies to the following versions of Splunk Cloud Platform: 7.0.13, 8.2.2107, 8.0.2006, 8.0.2007, 8.1.2009, 8.1.2011, 8.1.2012, 8.1.2101, 8.1.2103, 8.2.2104, 8.2.2105 (latest FedRAMP release), 8.2.2106

Was this documentation topic helpful?



0 out of 1000 Characters