Getting Data In

Is there any way to pass more metadata to the deployment server from universal forwarders?

jbresciani
New Member

Is there any way to pass more metadata to a deployment server from universal forwarders? I'm thinking either key/value pairs via conf files or something more dynamic like passing facter or ohai information.

0 Karma

lguinn2
Legend

Universal forwarders do not pass information to the deployment server - they poll and download information from the deployment server.

When the UF polls the deployment server, it supplies only its identifying information (GUID, etc) and maybe the hashes for its apps. (I am not exactly sure whether the client or the server does the hash comparison.) You cannot customize the info that the UF supplies to the deployment server.

You can put anything that you want in the apps that the UF downloads from the deployment server. The apps must follow the structure for regular Splunk apps.

Bottom line is "no." I don't believe that there is any way to do this.

Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...