topic can I pass additional source info from inputs.conf in Getting Data In

can I pass additional source info from inputs.conf

jangid — Mon, 28 Sep 2020 14:16:37 GMT

Is it possible to pass extra info from inputs.conf?

e.g. [inputs.conf]

[default]
host = my_host

[monitor://somepath]
sourcetype = my_source
additional_info = my_additional_info

I want this additional info from all the forwarder, due to some reason I can not use host name.

Thanks

Re: can I pass additional source info from inputs.conf

linu1988 — Mon, 08 Jul 2013 10:46:58 GMT

From the splunk documentation there is no additional parameters can be passed. But what is the difference between the sourcetype and additional_info? it's the same if we use in search.

Re: can I pass additional source info from inputs.conf

jangid — Mon, 08 Jul 2013 10:54:29 GMT

this is my custom information. I want to add this information along with sourcetype and is should be searchable. similar to sourcetype, source and host.

Re: can I pass additional source info from inputs.conf

sunrise — Mon, 08 Jul 2013 11:23:26 GMT

You need to set custom fields. Reference below URL.
But this is not recommended by Splunk.
http://docs.splunk.com/Documentation/Splunk/5.0.3/Data/Configureindex-timefieldextraction

Generally you should use custom fields at search time, editing props.conf or transforms.conf.
http://docs.splunk.com/Documentation/Splunk/5.0.3/Knowledge/Addfieldsatsearchtime