Getting Data In

Adding a field


I have about 30 Univ. forwarders on servers dedicated to clientX. I am currently sending the data to a specific index called clientX via props and transforms. The servers reside in different environments (dev, qa, prod, etc.).

I'd like to add a field at index time to indicate which environment the server belongs to, in order to have the ability to query just that environment (i.e. 'index=clientX env=qa')

Here is a sample of my current configs:


TRANSFORMS-clientX_Host = clientXHost

TRANSFORMS-clientX_Host = clientXHost


DEST_KEY = _MetaData:Index
FORMAT = clientX

I'm assuming I need to do something in transforms.conf to add the field, but am unsure.

Thanks in advance for the help.

0 Karma

Splunk Employee
Splunk Employee

I think an easier way to do this would be using tags. If you have a very large number of servers you could use a look up but in this case it would simply be adding the 'client' tag to the server and then you would be able to say 'tag=clientx' in your search.


Or for that matter lookup files if tags aren't desirable for some reason.

0 Karma