How to add _meta Tags to modular inputs, i.e. Netapp Ontap App

[mspoerr]

Hello,

we would like to add _meta Tags to data collected by the Hydra Scheduler or other modular inputs. For a standard inputs I can use the _meta = key::value format to add additional data, but I heard that this is not supported for modular inputs.

Thanks,
Mathias

[wcolgate_splunk · Accepted solution]

What version of splunk are you trying this out on? 6.3 should have this feature available for modular inputs. (And some previous version in a dot release).

[mspoerr]

We were using version 6.3.2 and upgraded to 6.4.2 a few weeks ago, but in the meanwhile we removed the tags. I'll add them again and check the result...
/Mathias

[wcolgate_splunk]

Here is a sample using the windows specific modular input splunk-winevtlog.exe's .conf file:

[default]
host = Win2k8sup04

[WinEventLog]
_meta= global::fromUF-master

[WinEventLog://System]
disabled = 0
_meta= test::SystemUF

[WinEventLog://Security]
disabled = 0

[WinEventLog://Application]
disabled = 0
_meta= test::ApplicationUF global::fromUF

The behavior in this example is:

The System stanza gets only one field test (it overrides the default).
The Security stanza gets only one field global (as set by default)
The application stanza gets both fields test and global (it overrides the default).