How to add metadata to ANY event by default?

[tpaulsen]

Hello,

we have several very spread environments and we have the need to have any event in our Splunk 5 to not only have metadata like host or source, but also two additional fields. I already took a close look into this: http://splunk-base.splunk.com/answers/1453/how-do-i-add-metadata-to-events-coming-from-a-splunk-forw... but that doesn´t fit in our case, since we would like to have ALL events by default getting the two additional fields, which btw. will be extracted from each Forwarder. How can we achieve this?

Thank you!

[tpaulsen]

Ok, we use the Lookup Table method, which we still have to half manually need to generate, but at least it´s working now.

We have a CSV with FQDN and all the other fields we need, and use an automatic lookup definition:

inventory_lookup fqdn AS fqdn OUTPUTNEW environment AS environment FOOgroup AS FOOgroup FOOvertical AS FOOvertical 

[stefandagerman]

Take a look here and note that this is NOT a recommended practice due to the impact on indexing performance

[tpaulsen]

Unfortunately the information can´t be retrieved by a RegEx. It is located in a properties file on each system.

[stefandagerman]

Not quite, the link talks about how to add metadata to indexed data, which is done through props/transforms/fields as well. If you want to add a metadata field to each event, that is how you need to do it.
So, the only open questions are:
What is your system property variable, i.e. where is it defined (environment, config file, etc.)?
and
Can you write a RegEx to retrieve that variable?
If you can't, I don't know of any way to achieve what you are trying to do.

[tpaulsen]

Hi, the link is refering to transform and props.conf which are used to extract data from the logfiles, indeed we want to inject data out of a different source, a system property variable, into each event. I still don´t get my head around how to do that.