topic Re: _meta and how it works in Getting Data In

_meta: How does it work?

tam82 — Fri, 12 Aug 2022 15:00:26 GMT

I am setting _meta at the app level can i also set it in the /system/local or will one override the other

For example

/myapp/inputs

_meta name::bill

/system/local/inputs

_meta last::dave

so then the indexer would get both bill and dave

Re: _meta and how it works

splunknewbie — Fri, 12 Aug 2022 14:41:55 GMT

I have the same problem.

I would like to use _meta under hec token definition.

It doesn't work either.

Re: _meta: How does it work?

gcusello — Fri, 12 Aug 2022 15:41:12 GMT

Hi @tam82 and @splunknewbie,

as you can read at https://docs.splunk.com/Documentation/Splunk/9.0.0/Admin/Inputsconf, it's possible to assign a field value using _meta, but why do you want to do this?

Ciao.

Giuseppe

Re: _meta and how it works

isoutamo — Fri, 17 May 2024 14:50:10 GMT

This has fixed by Splunk. It works at least 9.1.3+ versions as expected.
_meta = foo::bar

Re: _meta and how it works

PickleRick — Fri, 17 May 2024 21:04:51 GMT

What do you mean by "fixed"?

Assigning _meta worked "since always" (I've been using it for last 5 years or so).

But since it's a single setting, you can't just stack separate definitions from multiple files. Only one will be the "winning" one according to normal rules of config precedence.

Re: _meta and how it works

isoutamo — Fri, 31 May 2024 10:45:50 GMT

There was a bug with http inputs where it hasn't work earlier even it should. Nice that it has fixed and it works also with http input too.

Re: _meta and how it works

splunknewbie — Fri, 31 May 2024 15:30:38 GMT

is it fixed? under which version is fixed?

is there any technical documentation for that?

Thanks