Getting Data In
Highlighted

How to add _meta Tags to modular inputs, i.e. Netapp Ontap App

Explorer

Hello,

we would like to add _meta Tags to data collected by the Hydra Scheduler or other modular inputs. For a standard inputs I can use the _meta = key::value format to add additional data, but I heard that this is not supported for modular inputs.

Thanks,
Mathias

0 Karma
Highlighted

Re: How to add _meta Tags to modular inputs, i.e. Netapp Ontap App

Splunk Employee
Splunk Employee

What version of splunk are you trying this out on? 6.3 should have this feature available for modular inputs. (And some previous version in a dot release).

View solution in original post

Highlighted

Re: How to add _meta Tags to modular inputs, i.e. Netapp Ontap App

Explorer

We were using version 6.3.2 and upgraded to 6.4.2 a few weeks ago, but in the meanwhile we removed the tags. I'll add them again and check the result...
/Mathias

0 Karma
Highlighted

Re: How to add _meta Tags to modular inputs, i.e. Netapp Ontap App

Splunk Employee
Splunk Employee

Here is a sample using the windows specific modular input splunk-winevtlog.exe's .conf file:

[default]
host = Win2k8sup04

[WinEventLog]
_meta= global::fromUF-master

[WinEventLog://System]
disabled = 0
_meta= test::SystemUF

[WinEventLog://Security]
disabled = 0

[WinEventLog://Application]
disabled = 0
_meta= test::ApplicationUF global::fromUF

The behavior in this example is:

The System stanza gets only one field test (it overrides the default).
The Security stanza gets only one field global (as set by default)
The application stanza gets both fields test and global (it overrides the default).

0 Karma