All Apps and Add-ons

Unable to add custom field to wmi.conf like env=prod or stage

sraji
Explorer

Hello,

 

We have wmi.conf in place like below

[WMI:services]
wql = SELECT * FROM Win32_Process where Name like '%search%' OR Name like '%w3wp%'
interval = 300
disabled = 0
server = TestIN001

We wants to have events with environment like prod, stage & test and i have tried like below also but no luck

[WMI:services]
wql = SELECT * FROM Win32_Process where Name like '%search%' OR Name like '%w3wp%'
interval = 300
disabled = 0
server = TestIN001

_meta = environment::prod

 

Kindly help me on this if it is feasible somehow.

 

 

Labels (2)
Tags (1)
0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!