topic Re: Adding meta without changing splunk cloud in Splunk Enterprise

Adding meta without changing splunk cloud

ivaleev — Mon, 20 Jul 2020 14:25:30 GMT

We send data to Splunk Cloud from Universal Forwarder. I want to add _meta to each event sent to the Splunk Cloud.

I've added _meta to each stanza in the inputs.conf and restarted the Forwarder, but the meta does not appear in the Splunk Cloud

[default] host = HOSTNAME index = INDEX source = SOURCE # Monitor NGINX Logs [monitor:///var/log/nginx/access.json.log] disabled = false sourcetype = SOURCETYPE _meta = region::sae1 ...

What could I miss? Is it possible to add the meta without changes in the Splunk Cloud?

Re: Adding meta without changing splunk cloud

livehybrid — Tue, 21 Jul 2020 07:52:05 GMT

Hi,

I think you may still need to update fields.conf on Splunk Cloud with

[region] INDEXED = true

in order for Splunk to know that it is an indexed field.

(https://docs.splunk.com/Documentation/Splunk/latest/Admin/Fieldsconf)

Re: Adding meta without changing splunk cloud

ivaleev — Tue, 21 Jul 2020 15:56:18 GMT

Can it be done in Splunk Cloud user interface?