topic How can I add metadata to events at the forwarder? in Splunk Search

How can I add metadata to events at the forwarder?

rphillips_splk — Wed, 11 Apr 2018 21:13:33 GMT

I'd like to add metadata to my events at the source and change the _meta value periodically without restarting the forwarders.

Re: How can I add metadata to events at the forwarder?

rphillips_splk — Tue, 29 Sep 2020 18:58:51 GMT

forwarder:
inputs.conf
[monitor::///var/logs]
_meta = foo:bar

foo represents field name , bar represents field value

indexers:
fields.conf
[foo]
INDEXED = true

I also want to update the metadata value periodically without restarting Splunk on the forwarders.

$SPLUNK_HOME/bin
./splunk _internal call /services/data/inputs/monitor/_reload -auth admin:changeme

Re: How can I add metadata to events at the forwarder?

gravesb — Thu, 05 Dec 2019 21:06:40 GMT

In case anyone else runs across this, the proper syntax in the inputs.conf is
_meta = foo::bar
two colons between the key and value instead of one.

Re: How can I add metadata to events at the forwarder?

michaelissartel — Tue, 24 Oct 2023 15:43:26 GMT

Hi @rphillips_splk

bar can be an environment variable ?

thanks

Re: How can I add metadata to events at the forwarder?

rphillips_splk — Tue, 24 Oct 2023 19:37:05 GMT

@michaelissartel I haven't tested using an env variable as the field value before. If you do end up testing can you put your reply here for others?

Re: How can I add metadata to events at the forwarder?

michaelissartel — Wed, 25 Oct 2023 16:57:35 GMT

Hi, this solution has been cancelled 😕

Re: How can I add metadata to events at the forwarder?

michaelissartel — Thu, 26 Oct 2023 09:30:56 GMT

Hi @rphillips_splk where can I find the doc for commands like ./splunk _internal call /services/data/inputs/monitor/_reload -auth admin:changeme

Can I do a post whit it ?

Re: How can I add metadata to events at the forwarder?

PickleRick — Thu, 26 Oct 2023 10:23:00 GMT

No. The only "variable" (runtime-determined) parts of the config are those explicitly defined as such in specs.

For example - serverName parameter in [general] section of server.conf. The specs say that it can contain environment variables so it can be dynamically set. For other parameters you define constant values.