Dropping or Modifying data based on metadata tags

skirven — Mon, 08 Feb 2021 16:35:14 GMT

Hi folks,

I'm trying to figure out if and how I could drop data, or modify data based on a metadata tag. In looking at the props.conf spec, it seems you can only reference sourcetype, source or host. My inbound data is setting up a metadata tag of "namespace" (It's Splunk Connect for Kubernetes, if it helps any).

I did try [namespace::<value>], but it doesn't seem to work. I can't get specific enough with the existing choices of host, source or sourcetype.

My 2 use cases are:
1) Run a props.conf SEDCMD on some "cluster_name" only
2) Drop some "namespace" tags I don't want to ingest

And neither one of these appear to work, and may be expected not to, based on documentation?

Are there other options?
Thanks!
Stephen

Re: Dropping or Modifying data based on metadata tags

mattymo — Sun, 28 Feb 2021 14:14:53 GMT

Hi! Splunk Connect for Kubernetes utilizes Fluentd which provides a ton of control over what gets sent to Splunk. While you should be able to do some props and transforms, like you said, probably more flexible at the collector.

Mind providing an example of the filter you would like to express? I could try and walk you through crafting a custom filter which connect for k8s lets you add to your config.

topic Dropping or Modifying data based on metadata tags in Getting Data In

Dropping or Modifying data based on metadata tags

Re: Dropping or Modifying data based on metadata tags