Dropping or Modifying data based on metadata tags

[skirven]

Hi folks,

   I'm trying to figure out if and how I could drop data, or modify data based on a metadata tag. In looking at the props.conf spec, it seems you can only reference sourcetype, source or host. My inbound data is setting up a metadata tag of "namespace" (It's Splunk Connect for Kubernetes, if it helps any).

I did try [namespace::<value>], but it doesn't seem to work. I can't get specific enough with the existing choices of host, source or sourcetype. 

My 2 use cases are:
1) Run a props.conf SEDCMD on some "cluster_name" only
2) Drop some "namespace" tags I don't want to ingest

And neither one of these appear to work, and may be expected not to, based on documentation?

Are there other options?
Thanks!
Stephen

[mattymo]

Hi! Splunk Connect for Kubernetes utilizes Fluentd which provides a ton of control over what gets sent to Splunk. While you should be able to do some props and transforms, like you said, probably more flexible at the collector. 

Mind providing an example of the filter you would like to express?  I could try and walk you through crafting a custom filter which connect for k8s lets you add to your config.