Hello,
I have several HFs.
I would like to set a new metadata HF_x to identify the HF server.
In the /opt/splunk/etc/system/local/inputs.conf I added
_meta = server_hf::server1
After restart of the HF, I noticed that this new metadata is set on the events of the _internal index but not on the events that were retrieved by dbconnect.
Could you tell me if it is possible to define a new metadata on a HF and have it associate to the events retrieved by DB connect or modular input?
Regards
