How to differentiate between different redis hosts using Redis Add-on for Splunk?

[sk314]

I am trying to pull logs from three redis servers. I have them configured as separate inputs. However, I am unable to differentiate the logs using any metadata or field. I am sure I am missing something trivial. Would anyone shed some light on this?

[svasani_splunk]

I've updated the add-on to v1.0.3 to add the host.

[xavierashe · Accepted solution]

For any input, including modinputs you can add a host field to the inputs.conf like so. The inputs.conf is in the $Splunk_Home/apps/TA-splunk-addon-for-redis-server/local directory.

 [redis://www_cs01]
 authentication = password
 index = www
 interval = 60
 password = ********
 redis_host = wwwcs01
 redis_port = 6379
 host=wwwcs01

 [redis://www_cs02]
 authentication = password
 index = www
 interval = 60
 password = ********
 redis_host = wwwcs02
 redis_port = 6379
 host = wwwcs02

 [redis://www_cs03]
 authentication = password
 index = www
 interval = 60
 password = ********
 redis_host = wwwcs03
 redis_port = 6379
 host=wwwcs03

[xavierashe]

If they are coming from different servers, then the field you would use to differentiate is 'host'.

[sk314]

These are modular inputs configured on a data collector that has the add-on installed. The host field is populated by the hostname of the data collector instance.

[xavierashe]

Ah, that makes sense. Can you post your inputs.conf from $Splunk_Home/apps/TA-splunk-addon-for-redis-server/local?

[sk314]

[redis://www_cs01]
authentication = password
index = www
interval = 60
password = ********
redis_host = wwwcs01
redis_port = 6379

[redis://www_cs02]
authentication = password
index = www
interval = 60
password = ********
redis_host = wwwcs02
redis_port = 6379

[redis://www_cs03]
authentication = password
index = www
interval = 60
password = ********
redis_host = wwwcs03
redis_port = 6379

[sk314]

Not sure if I can add a host= entry in these mod inputs.

[xavierashe]

Give it a try and see if it works. I have the GitHub TA and it was built in the same way as this Redis. I have the host entry there and it works.

[sk314]

That worked! I knew it was going to be a trivial thing. I do wish the inputs automatically added either the redis_host field or made a host=field by itself. Thanks.