topic Re: MetaData Values: Is there a difference between DEST_KEY = _MetaData:Index versus DEST_KEY = MetaData:Index? in Getting Data In

MetaData Values: Is there a difference between DEST_KEY = _MetaData:Index versus DEST_KEY = MetaData:Index?

Murali2888 — Tue, 29 Sep 2020 06:46:38 GMT

Is there any difference between the two below?

DEST_KEY = _MetaData:Index
DEST_KEY = MetaData:Index

Also, I would like to understand why the host, source, and sourcetype values are shown as MetaData:Host, whereas the index shows _MetaData:Index

Thanks for your help.

Regards
Murali

Re: MetaData Values: Is there a difference between DEST_KEY = _MetaData:Index versus DEST_KEY = MetaData:Index?

lguinn2 — Thu, 23 Jul 2015 16:38:59 GMT

YES! There is a difference. Keys must be typed exactly as specified. The transform will not work otherwise.

I don't know why there is a difference between the keys that start with an underscore ( _ ) and those that do not. There is nothing in the documentation about that. My guess is that the difference is that the _ is used for metadata fields that are not stored in the journaled rawdata. Even if I am right, there is nothing that you or I can do about it, anyway; some keys start with _ and some don't!

Re: MetaData Values: Is there a difference between DEST_KEY = _MetaData:Index versus DEST_KEY = MetaData:Index?

Murali2888 — Fri, 24 Jul 2015 01:01:06 GMT

Thanks Iguinn for your comments.

There is no clear documentation available as to which keys need to be prefixed by ( _ ). I was hoping somebody would have some idea around this.

Re: MetaData Values: Is there a difference between DEST_KEY = _MetaData:Index versus DEST_KEY = MetaData:Index?

saurabh_tek11 — Wed, 20 Dec 2017 07:06:20 GMT

@Murali2888, DEST_KEY = MetaData:Index would be incorrect. Have a look on KEYS of transform.conf

Correct syntax as per splunk is _MetaData:Index, it defines the alternate index where the event shall be stored.

KEYs are case sensitive. NOTE: Any KEY (field name) prefixed by '_' is not indexed by Splunk, in general.

Re: MetaData Values: Is there a difference between DEST_KEY = _MetaData:Index versus DEST_KEY = MetaData:Index?

saurabh_tek11 — Fri, 22 Dec 2017 09:49:15 GMT

@Murali2888 hope this helps.