Assign Splunk default fields

AI summary

Explains how to assign Splunk default fields — index, source, and sourcetype — to Lumi events. Covers three methods: IAM key attributes, forwarding agents, and pipelines. Describes default values for HEC and S3 pull integrations and how to choose the right processor for pipeline assignment.

About AI summaries.

Splunk® default fields—index, source, and sourcetype—provide metadata about incoming events that control how to index and parse events. In Imply Lumi, you can store these values as user attributes on events. User attribute assignment happens at various stages in the event lifecycle. This topic describes methods for setting Splunk default fields as user attributes.

For how index affects federated search access and routing and how sourcetype triggers predefined pipelines, see Lumi concepts for Splunk users.

Methods overview

You can use a pipeline, your forwarding agent, or IAM key attributes to assign user attributes. The method you choose depends on your integration and how much control you need. The following table summarizes the available approaches:

Method	Good for	Available for	Precedence
Pipeline	Per-event logic, conditional values, overriding upstream values	Any integration	Highest
Forwarding agent	Setting values before events reach Lumi	Any integration	Middle
IAM key attribute	Applying a single default to all events on a key	HEC, S3 pull	Lowest

For the full user attribute precedence model, see Event model. For additional guidance on when to use IAM key attributes or pipelines, see Selection criteria.

IAM key attribute

For HEC and S3 pull, you can set default values for index, source, and sourcetype directly on the IAM key. These defaults apply when you don't assign the fields using a forwarding agent or pipeline.

To set IAM key attributes:

1. From the Lumi navigation menu, click Keys and select or create an IAM key.
2. Add or edit the Splunk HEC or S3 pull integration on the key.
3. Set Index, Source, and Source type as needed.
4. Click Save.

If you don't assign these IAM key attributes for S3 pull, Lumi doesn't assign any user attributes.

For Splunk HEC, if you don't assign the IAM key attributes, Lumi applies the default values index: main and sourcetype: httpevent.

The IAM key attributes are specific to the configured integration. If you reuse the same IAM key for both integrations, confirm the default field settings for each one. For details, see IAM keys.

Forwarding agent

You can assign Splunk default fields with any forwarding agent that supports adding key-value metadata. Values set by the forwarding agent override IAM key defaults. The following sections show examples for different forwarding methods.

Splunk forwarders

When you use S2S or S3 ingest actions, the Splunk forwarder assigns Splunk default fields from inputs.conf before the event reaches Lumi. Lumi automatically stores them as user attributes.

Note that sourcetype determines which predefined pipeline, if any, processes your events in Lumi. If you have a Splunk technology add-on (TA) that processes events, it can change the value of sourcetype, for example, from palo.log to pan:traffic. Make sure your forwarder sets the value your predefined pipelines expect, else override it using a custom pipeline.

Splunk HEC

For Splunk HEC requests, you assign index, source, or sourcetype values as top-level fields in the request body. For example, in curl:

curl -X POST \
     -H "Content-Type: application/json" \
     -H "Authorization: Splunk 229a2561-0000-0000-0000-bc433de16f89" \
     -d '{"event": "Demo log", "index": "main", "source": "curl", "sourcetype": "httpevent"}' \
  https://splunk-hec.us1.api.lumi.imply.io/services/collector

OTel collector

If you use an OTel collector, add the fields in the attributes processor in your collector configuration. For example:

processors:
    attributes/add_metadata:
        actions:
            - key: index
              value: "prod"
              action: insert
            - key: source
              value: "otel-collector"
              action: insert
            - key: sourcetype
              value: "access_combined"
              action: insert

Pipeline

A pipeline can assign or override Splunk default fields at ingestion time. Pipeline values take precedence over both forwarding agents and IAM key defaults.

To assign a field using a pipeline:

1. Create a pipeline and set conditions to target the relevant events.
2. Add a processor for each field you want to assign:
   • Assign a static value: Use a value mapper. Set the output attribute to index, source, or sourcetype and enter the value.
   • Copy from another attribute: Use an attribute mapper. Set the source and output attributes.
   • Assign conditionally: Use a conditional mapper. Define conditions and map different values per condition.
3. Save the pipeline.
4. Reorder the pipeline as needed. For example, if the conditions for a predefined pipeline relies on a field created in this pipeline, ensure that this pipeline precedes the predefined pipeline.
5. Optionally, simulate the pipeline to verify events have the expected field values.

Learn more

For more information, see the following topics:

• Lumi concepts for Splunk users to learn how index and sourcetype maps between Splunk and Lumi.
• Event model to understand user attribute precedence.
• IAM keys to learn about key attributes and reusing IAM keys.
• Manage IAM keys to create and edit IAM keys.
• Manage pipelines and processors to create and edit pipelines.
• Search events with Splunk to set up federated search.