topic Re: How to add _meta Tags to modular inputs, i.e. Netapp Ontap App in Getting Data In

How to add _meta Tags to modular inputs, i.e. Netapp Ontap App

mspoerr — Thu, 10 Mar 2016 22:00:13 GMT

Hello,

we would like to add _meta Tags to data collected by the Hydra Scheduler or other modular inputs. For a standard inputs I can use the _meta = key::value format to add additional data, but I heard that this is not supported for modular inputs.

Thanks,
Mathias

Re: How to add _meta Tags to modular inputs, i.e. Netapp Ontap App

wcolgate_splunk — Tue, 06 Sep 2016 17:06:04 GMT

What version of splunk are you trying this out on? 6.3 should have this feature available for modular inputs. (And some previous version in a dot release).

Re: How to add _meta Tags to modular inputs, i.e. Netapp Ontap App

mspoerr — Wed, 07 Sep 2016 08:35:30 GMT

We were using version 6.3.2 and upgraded to 6.4.2 a few weeks ago, but in the meanwhile we removed the tags. I'll add them again and check the result...
/Mathias

Re: How to add _meta Tags to modular inputs, i.e. Netapp Ontap App

wcolgate_splunk — Wed, 07 Sep 2016 15:28:27 GMT

Here is a sample using the windows specific modular input splunk-winevtlog.exe's .conf file:

[default]
host = Win2k8sup04

[WinEventLog]
_meta= global::fromUF-master

[WinEventLog://System]
disabled = 0
_meta= test::SystemUF

[WinEventLog://Security]
disabled = 0

[WinEventLog://Application]
disabled = 0
_meta= test::ApplicationUF global::fromUF

The behavior in this example is:

The System stanza gets only one field test (it overrides the default).
The Security stanza gets only one field global (as set by default)
The application stanza gets both fields test and global (it overrides the default).