All Apps and Add-ons

Splunk App/Add-on for AWS: How to add _meta information to AWS Description and Cloudwatch inputs

rainerzufall
Path Finder

Hello,

How can we add custom _meta Tags to AWS Description and Cloudwatch inputs since specialized conf files are used to collect these? I tried to add the _meta command to aws_description_tasks.conf and aws_cloudwatch_logs_tasks.conf, but get an error that this command is not supported.

Thanks,
Rainer

0 Karma
1 Solution

rainerzufall
Path Finder

I found a solution:
The missing input stanzas for Description and Cloudwatch in /local/inputs.conf can be added the following way:

[aws_description://CONFIGURED-DESCRIPTION-INPUT-NAME-IN-GUI]
_meta = tag1::value1 tag2::value2

[aws_cloudwatch_logs:://CONFIGURED-CLOUDWATCH-INPUT-NAME-IN-GUI]
meta = tag1::value1 tag2::value2

View solution in original post

0 Karma

rainerzufall
Path Finder

I found a solution:
The missing input stanzas for Description and Cloudwatch in /local/inputs.conf can be added the following way:

[aws_description://CONFIGURED-DESCRIPTION-INPUT-NAME-IN-GUI]
_meta = tag1::value1 tag2::value2

[aws_cloudwatch_logs:://CONFIGURED-CLOUDWATCH-INPUT-NAME-IN-GUI]
meta = tag1::value1 tag2::value2
0 Karma

vinceskahan
Path Finder

Rainier - that format works in inputs.conf on a universalforwarder for me, just as you wrote it....assuming the tag1 and tag2 fields are known on the server side of course.

0 Karma

rainerzufall
Path Finder

yes, but the mentioned two inputs are not defined in inputs.conf - there are special conf files for them which do not accept _meta

0 Karma

jzhong_splunk
Splunk Employee
Splunk Employee

Hi Rainer, are you talking about the EC2 instance tags you assigned via AWS Management console? They are available in the Config data. The AWS Description or Metadata(on AWS App) are mainly to collect the runtime information of the instances/vpc/securityGroup. You can try enabling the Config data for that region, then all tags will be available in Config JSON files. You can then search by tags.

rainerzufall
Path Finder

thank you for your answer. I would like to add additional custom tags like "_meta = tag1::value1 tag2::value2"...

0 Karma

vinceskahan
Path Finder

absolutely - me too...... I've been trying to find a way to add multiple custom metadata for months. The best I can come up with is one long ugly value that I can tear apart at search time:

_meta = myfields::tag1=value1,tag2=value2,tag3=value3

I'd much better be able to add greater-than-one custom fields at index time....

0 Karma
Get Updates on the Splunk Community!

Security Highlights | November 2022 Newsletter

 November 2022 2022 Gartner Magic Quadrant for SIEM: Splunk Named a Leader for the 9th Year in a RowSplunk is ...

Platform Highlights | November 2022 Newsletter

 November 2022 Skill Up on Splunk with our New Builder Tech Talk SeriesCan you build it? Yes you can! *play ...

Splunk Education - Fast Start Program!

Welcome to Splunk Education! Splunk training programs are designed to enable you to get started quickly and ...