Is it possible to add _meta fields in DB Connect?

[las]

Hi.

We have been forced to add identifiers to the collection tier in our Splunk environment. The way we have solved it, is using _meta with a couple of fields.

Now we have some DB data that is getting indexed and we would like to tag these data the same way.
The easy part was editing the /local/inputs.conf file and adding the extra line to all the input stanzas - this unfortunately didn't work and as far as I can read the db_inputs.conf doesn't allow the _meta line in the stanzas.

Does anyone have an idea, how to solve this problem, my thougths run in the direction of index-eval, but that is a more complex setup.

Kind regards

las

[livehybrid · Accepted solution]

Hi @las 

It isnt possible to add these directly, however you could look to add your meta field with props/transforms based on your source or sourcetype - For example:

== props.conf == 
[source::MyDBInput]
TRANSFORMS-set_customerid = set_customerid

== transforms.conf ==
[set_customerid]
REGEX = .
FORMAT = CustomerID::CustomerABC
WRITE_META = true

= Or with INGEST_EVAL =
[set_customerid]
INGEST_EVAL = CustomerID="CustomerABC"

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[las]

Hi @livehybrid 

Thanks for the reply, it was as I also could read in the docs, but nice to get it confirmed.

Kind regards

las