All Apps and Add-ons

new custom metadata for dbconnect events

Path Finder


I have several HFs.
I would like to set a new metadata HF_x to identify the HF server.

In the /opt/splunk/etc/system/local/inputs.conf I added
_meta = server_hf::server1

After restart of the HF, I noticed that this new metadata is set on the events of the _internal index but not on the events that were retrieved by dbconnect.

Could you tell me if it is possible to define a new metadata on a HF and have it associate to the events retrieved by DB connect or modular input?


0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!