Getting Data In

Dropping or Modifying data based on metadata tags

skirven
Communicator

Hi folks,

   I'm trying to figure out if and how I could drop data, or modify data based on a metadata tag. In looking at the props.conf spec, it seems you can only reference sourcetype, source or host. My inbound data is setting up a metadata tag of "namespace" (It's Splunk Connect for Kubernetes, if it helps any).

I did try [namespace::<value>], but it doesn't seem to work. I can't get specific enough with the existing choices of host, source or sourcetype. 

My 2 use cases are:
1) Run a props.conf SEDCMD on some "cluster_name" only
2) Drop some "namespace" tags I don't want to ingest

And neither one of these appear to work, and may be expected not to, based on documentation?

Are there other options?
Thanks!
Stephen

Labels (2)
0 Karma

mattymo
Splunk Employee
Splunk Employee

Hi! Splunk Connect for Kubernetes utilizes Fluentd which provides a ton of control over what gets sent to Splunk. While you should be able to do some props and transforms, like you said, probably more flexible at the collector. 

Mind providing an example of the filter you would like to express?  I could try and walk you through crafting a custom filter which connect for k8s lets you add to your config. 

- MattyMo
0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...