UF to send both Hostname and IP Address as metadata. Currently either IP or hostname is supported as host field

SunilkumarG — Wed, 18 Aug 2021 05:02:23 GMT

We can have either IP address or hostname for host field, both is not supported yet. Below highlighted config in inputs.conf will force to set host as IP address:

host = localhost

connection_host = ip

we tried to explore _meta field coming from UF. If we can make that dynamic to support variable, then we can have both IP and hostname.

This would be similar to $decideOnStartup functionality for host field, but more flexible.

Has anyone able to send both IP and Hostname dynamically for indexing through UF?

For example:

$hostname$ will yield hostname.. as used with inputs.conf, it would be

[default]

_meta = splunk_forwarder::$hostname$

topic UF to send both Hostname and IP Address as metadata. Currently either IP or hostname is supported as host field in Splunk Dev

UF to send both Hostname and IP Address as metadata. Currently either IP or hostname is supported as host field