Getting Data In

How do I add a dynamic field to an inputs.conf file?

arlington
Explorer

I have logs which are monitored by a Splunk forwarder, but what I want to do is add dynamic fields to an event, which will be generated as a result of any script or command (for example with curl).

I know one way, with scripted input, is to create a script that reads logs and parallel add any value to the result.

Do we have another more elegant way of doing this? I searched but I couldn't find anything.

0 Karma
1 Solution

chrisyounger
SplunkTrust
SplunkTrust

Hi @arlington

The most elegant way to enrich events is to have a script that populates a CSV which is then used as an automatic lookup. A good example is the identity and asset lookups in Enterprise Security that work like this. They are very performant even for huge lookups.

If you want to enrich an event and your absolutly can't pre-compute the data, then use a script (external) lookup https://docs.splunk.com/Documentation/Splunk/7.2.3/Knowledge/Configureexternallookups or a custom command: https://docs.splunk.com/Documentation/Splunk/7.2.3/Search/Writeasearchcommand

All the best.

View solution in original post

chrisyounger
SplunkTrust
SplunkTrust

Hi @arlington

The most elegant way to enrich events is to have a script that populates a CSV which is then used as an automatic lookup. A good example is the identity and asset lookups in Enterprise Security that work like this. They are very performant even for huge lookups.

If you want to enrich an event and your absolutly can't pre-compute the data, then use a script (external) lookup https://docs.splunk.com/Documentation/Splunk/7.2.3/Knowledge/Configureexternallookups or a custom command: https://docs.splunk.com/Documentation/Splunk/7.2.3/Search/Writeasearchcommand

All the best.

arlington
Explorer

Actually what I am trying to do is add Instance ID or any TAG from EC2 instance to my apps event. But still I can't find a proper solution how to do that. Using host field is not reliable to match in lookup, because if instance going to be destroyed it's ip and host name release and will be assigned to newly created instance in future. As Instance ID is unique across whole AWS environmet I would like to use that. But in order to do that need add instance id to all events which I am forwarding with splunkforwarder. Instance ID are accessible with the curl command inside current running instance. Any idea on that?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...