All Apps and Add-ons

new custom metadata for dbconnect events



I have several HFs.
I would like to set a new metadata HF_x to identify the HF server.

In the /opt/splunk/etc/system/local/inputs.conf I added
_meta = server_hf::server1

After restart of the HF, I noticed that this new metadata is set on the events of the _internal index but not on the events that were retrieved by dbconnect.

Could you tell me if it is possible to define a new metadata on a HF and have it associate to the events retrieved by DB connect or modular input?


Loves-to-Learn Lots


did you resolved this?

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...