Getting Data In

Dropping or Modifying data based on metadata tags

skirven
Communicator

Hi folks,

   I'm trying to figure out if and how I could drop data, or modify data based on a metadata tag. In looking at the props.conf spec, it seems you can only reference sourcetype, source or host. My inbound data is setting up a metadata tag of "namespace" (It's Splunk Connect for Kubernetes, if it helps any).

I did try [namespace::<value>], but it doesn't seem to work. I can't get specific enough with the existing choices of host, source or sourcetype. 

My 2 use cases are:
1) Run a props.conf SEDCMD on some "cluster_name" only
2) Drop some "namespace" tags I don't want to ingest

And neither one of these appear to work, and may be expected not to, based on documentation?

Are there other options?
Thanks!
Stephen

Labels (2)
0 Karma

mattymo
Splunk Employee
Splunk Employee

Hi! Splunk Connect for Kubernetes utilizes Fluentd which provides a ton of control over what gets sent to Splunk. While you should be able to do some props and transforms, like you said, probably more flexible at the collector. 

Mind providing an example of the filter you would like to express?  I could try and walk you through crafting a custom filter which connect for k8s lets you add to your config. 

- MattyMo
0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...