All Apps and Add-ons

Splunk App/Add-on for AWS: How to add _meta information to AWS Description and Cloudwatch inputs

rainerzufall
Path Finder

Hello,

How can we add custom _meta Tags to AWS Description and Cloudwatch inputs since specialized conf files are used to collect these? I tried to add the _meta command to aws_description_tasks.conf and aws_cloudwatch_logs_tasks.conf, but get an error that this command is not supported.

Thanks,
Rainer

0 Karma
1 Solution

rainerzufall
Path Finder

I found a solution:
The missing input stanzas for Description and Cloudwatch in /local/inputs.conf can be added the following way:

[aws_description://CONFIGURED-DESCRIPTION-INPUT-NAME-IN-GUI]
_meta = tag1::value1 tag2::value2

[aws_cloudwatch_logs:://CONFIGURED-CLOUDWATCH-INPUT-NAME-IN-GUI]
meta = tag1::value1 tag2::value2

View solution in original post

0 Karma

rainerzufall
Path Finder

I found a solution:
The missing input stanzas for Description and Cloudwatch in /local/inputs.conf can be added the following way:

[aws_description://CONFIGURED-DESCRIPTION-INPUT-NAME-IN-GUI]
_meta = tag1::value1 tag2::value2

[aws_cloudwatch_logs:://CONFIGURED-CLOUDWATCH-INPUT-NAME-IN-GUI]
meta = tag1::value1 tag2::value2
0 Karma

vinceskahan
Path Finder

Rainier - that format works in inputs.conf on a universalforwarder for me, just as you wrote it....assuming the tag1 and tag2 fields are known on the server side of course.

0 Karma

rainerzufall
Path Finder

yes, but the mentioned two inputs are not defined in inputs.conf - there are special conf files for them which do not accept _meta

0 Karma

jzhong_splunk
Splunk Employee
Splunk Employee

Hi Rainer, are you talking about the EC2 instance tags you assigned via AWS Management console? They are available in the Config data. The AWS Description or Metadata(on AWS App) are mainly to collect the runtime information of the instances/vpc/securityGroup. You can try enabling the Config data for that region, then all tags will be available in Config JSON files. You can then search by tags.

rainerzufall
Path Finder

thank you for your answer. I would like to add additional custom tags like "_meta = tag1::value1 tag2::value2"...

0 Karma

vinceskahan
Path Finder

absolutely - me too...... I've been trying to find a way to add multiple custom metadata for months. The best I can come up with is one long ugly value that I can tear apart at search time:

_meta = myfields::tag1=value1,tag2=value2,tag3=value3

I'd much better be able to add greater-than-one custom fields at index time....

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...