https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-send-host-grouping-information-from-a/m-p/194042#M38645 <P>Splunk records pretty limited information per-event; your best bet would be to either have a lookup field (which you mentioned may not work), filters as a set of macros or eventtypes (again, based on static info), or to have it built-in to one of the default metadata-scraped fields:</P> <UL> <LI>Have it built-in to the "host" field (ex: have domain portions of the FQDN identify grouping)</LI> <LI>Have it built-in to the "source" field (ex: prefix/suffix source value with a tag - I've seen this done where we had "grouping" built-in to the directories of the log files we were scraping)</LI> <LI>Have it built-in to the "sourcetype" field (entirely dependent on your environment, but I'd generally prefer to have slightly broader sourcetypes)</LI> </UL> Thu, 15 Jan 2015 20:40:42 GMT srioux 2015-01-15T20:40:42Z https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-send-host-grouping-information-from-a/m-p/194041#M38644 <P>In an inputs.conf I can define a forwarder's host field which I can use in searches. Identifying a single host is not always enough, e.g., we have build servers, source code management servers, filers etc. to monitor - a kind of grouping would come in handy in order to limit searches to a certain group of hosts. We could do that by maintaining lists and using them as look-ups, but I was wondering whether there's the possibility to achieve that on the forwarder with just configuration. Example:</P> <P>inputs.conf on host A:<BR /> <PRE><BR /> host=hosta<BR /> group=build_servers<BR /> </PRE><BR /> inputs.conf on host B:<BR /> <PRE><BR /> host=hostb<BR /> group=git_servers<BR /> </PRE></P> <P>I want to be able to search for something like <PRE>search host=* group="build_servers" sourcetype="df" ... | ...</PRE></P> <P>Is there a way to do this?</P> Mon, 28 Sep 2020 18:41:19 GMT https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-send-host-grouping-information-from-a/m-p/194041#M38644 d044160 2020-09-28T18:41:19Z https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-send-host-grouping-information-from-a/m-p/194042#M38645 <P>Splunk records pretty limited information per-event; your best bet would be to either have a lookup field (which you mentioned may not work), filters as a set of macros or eventtypes (again, based on static info), or to have it built-in to one of the default metadata-scraped fields:</P> <UL> <LI>Have it built-in to the "host" field (ex: have domain portions of the FQDN identify grouping)</LI> <LI>Have it built-in to the "source" field (ex: prefix/suffix source value with a tag - I've seen this done where we had "grouping" built-in to the directories of the log files we were scraping)</LI> <LI>Have it built-in to the "sourcetype" field (entirely dependent on your environment, but I'd generally prefer to have slightly broader sourcetypes)</LI> </UL> Thu, 15 Jan 2015 20:40:42 GMT https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-send-host-grouping-information-from-a/m-p/194042#M38645 srioux 2015-01-15T20:40:42Z https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-send-host-grouping-information-from-a/m-p/194043#M38646 <P>I almost suspected that. Thanks for summarizing my options ... "host" and "source" won't work because those are outside my jurisdiction (I don't own the monitorees) and I agree, abusing "sourcetype" for that purpose would harm "sourcetype" as a more or less well-known concept in my Splunk deployment.</P> Fri, 16 Jan 2015 14:52:37 GMT https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-send-host-grouping-information-from-a/m-p/194043#M38646 d044160 2015-01-16T14:52:37Z