Hello All,
Our client would like to be able to annotate their configuration stanzas with metadata about the ingestion (e.g. date of setup, business unit, application ID, person who did configuration, etc.) None of this data will actually used by Splunk, it's just us tagging data into the stanzas. So as an example, I have the following config stanza:
[monitor://C:\GitRepos\service-information-display-svc\logs]
disabled = false
index = localindex
sourcetype = _json
host = LALA_ONE
We'd like to do something like this via the API:
[monitor://C:\GitRepos\service-information-display-svc\logs]
disabled = false
index = localindex
sourcetype = _json
host = LALA_ONE
_createdby = scossette
_dateCreated = 07302018
_appId = 054838
_businessUnit = sales
When trying to add them through the APIs, it comes back as an HTTP 400... most likely because the parameter names are not supported via Splunk. Is this even possible? If so, how?
Thanks in Advance,
Steve
