<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Question regarding _meta on multi-tenant hosts in Getting Data In</title>
    <link>https://community.splunk.com/t5/Getting-Data-In/Question-regarding-meta-on-multi-tenant-hosts/m-p/532687#M89532</link>
    <description>&lt;P&gt;Hey guys,&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;I had a quick question that I am unable to get an answer for by googling/doc'ing. If I am wanting to tag a server by using /etc/system/local/inputs.conf, am I able to apply this _meta field to various sources as opposed to only sourcetypes?&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;For example, we are needing to give specific tags to each respective log file location on a server. One location, will have _meta = altci::examplea and the other will have _meta = altci::exampleb.&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;It would look like this:&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;[default]&lt;/P&gt;&lt;P&gt;hostname = $decideOnStartUp&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;[F:\logFiles\inetpub\*.log]&lt;/P&gt;&lt;P&gt;_meta = altci:examplea&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;[C:\logFiles\inetpub\*.log]&lt;/P&gt;&lt;P&gt;_meta = altci:exampleb&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;Reason being is a few of our servers are legacy and host numerous sites/apps. Blah. I know it sucks, but it's a few old servers that are pretty important!&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;Thanks!!&lt;/P&gt;</description>
    <pubDate>Thu, 10 Dec 2020 17:12:36 GMT</pubDate>
    <dc:creator>dfurtaw</dc:creator>
    <dc:date>2020-12-10T17:12:36Z</dc:date>
    <item>
      <title>Question regarding _meta on multi-tenant hosts</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Question-regarding-meta-on-multi-tenant-hosts/m-p/532687#M89532</link>
      <description>&lt;P&gt;Hey guys,&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;I had a quick question that I am unable to get an answer for by googling/doc'ing. If I am wanting to tag a server by using /etc/system/local/inputs.conf, am I able to apply this _meta field to various sources as opposed to only sourcetypes?&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;For example, we are needing to give specific tags to each respective log file location on a server. One location, will have _meta = altci::examplea and the other will have _meta = altci::exampleb.&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;It would look like this:&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;[default]&lt;/P&gt;&lt;P&gt;hostname = $decideOnStartUp&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;[F:\logFiles\inetpub\*.log]&lt;/P&gt;&lt;P&gt;_meta = altci:examplea&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;[C:\logFiles\inetpub\*.log]&lt;/P&gt;&lt;P&gt;_meta = altci:exampleb&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;Reason being is a few of our servers are legacy and host numerous sites/apps. Blah. I know it sucks, but it's a few old servers that are pretty important!&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;Thanks!!&lt;/P&gt;</description>
      <pubDate>Thu, 10 Dec 2020 17:12:36 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Question-regarding-meta-on-multi-tenant-hosts/m-p/532687#M89532</guid>
      <dc:creator>dfurtaw</dc:creator>
      <dc:date>2020-12-10T17:12:36Z</dc:date>
    </item>
  </channel>
</rss>

