How to utilize environmental variable in props.conf?

[oliverja]

This has been asked before, and the questions seems to die. So here I am with a slightly different use case/phrasing.

Dearest Splunk Devs, please let me use environmental variables in my configs.

Issue:

1. I have several heavy forwarders collecting logs from different endpoints.
   
   
2. My users need to know which heavy forwarder the logs passed through. 
   
   
3. I want to add the Heavy Forwarder's hostname to the log as "collector"

Current situaiton:

transforms.conf

[addmeta]
REGEX = .
FORMAT = collector::$HOSTNAME
WRITE_META = true

props.conf

[generic_single_line]
TRANSFORMS-addmeta = addmeta

This results in the unfortunate log:

4/6/22
1:01:17.000 PM	
testing my props.conf with a simple log
collector = $HOSTNAME
sourcetype = generic_single_line

But what SHOULD be happening:

4/6/22
1:01:17.000 PM	
testing my props.conf with a simple log
collector = EventCollect01.domain.com
sourcetype = generic_single_line

What can I do to pull some sort of internal variable instead of hardcoding the host?

[OzUK]

I have this exact issue too, we have hundreds of UFs managed with CICD and want a way to stamp where logs are ingested from... how do we do this?

[oliverja]

FYI -- here is my suggestion I posted.

https://ideas.splunk.com/ideas/DSPID-I-167

[richgalloway]

There are only a few instances where environment variables are honored and props.conf is not among them.

Go to https://ideas.splunk.com to request it.