Getting Data In

How to add _meta Tags to modular inputs, i.e. Netapp Ontap App

mspoerr
Path Finder

Hello,

we would like to add _meta Tags to data collected by the Hydra Scheduler or other modular inputs. For a standard inputs I can use the _meta = key::value format to add additional data, but I heard that this is not supported for modular inputs.

Thanks,
Mathias

0 Karma
1 Solution

wcolgate_splunk
Splunk Employee
Splunk Employee

What version of splunk are you trying this out on? 6.3 should have this feature available for modular inputs. (And some previous version in a dot release).

View solution in original post

wcolgate_splunk
Splunk Employee
Splunk Employee

What version of splunk are you trying this out on? 6.3 should have this feature available for modular inputs. (And some previous version in a dot release).

mspoerr
Path Finder

We were using version 6.3.2 and upgraded to 6.4.2 a few weeks ago, but in the meanwhile we removed the tags. I'll add them again and check the result...
/Mathias

0 Karma

wcolgate_splunk
Splunk Employee
Splunk Employee

Here is a sample using the windows specific modular input splunk-winevtlog.exe's .conf file:

[default]
host = Win2k8sup04

[WinEventLog]
_meta= global::fromUF-master

[WinEventLog://System]
disabled = 0
_meta= test::SystemUF

[WinEventLog://Security]
disabled = 0

[WinEventLog://Application]
disabled = 0
_meta= test::ApplicationUF global::fromUF

The behavior in this example is:

The System stanza gets only one field test (it overrides the default).
The Security stanza gets only one field global (as set by default)
The application stanza gets both fields test and global (it overrides the default).

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...