Getting Data In

Is there any way to pass more metadata to the deployment server from universal forwarders?

New Member

Is there any way to pass more metadata to a deployment server from universal forwarders? I'm thinking either key/value pairs via conf files or something more dynamic like passing facter or ohai information.

0 Karma


Universal forwarders do not pass information to the deployment server - they poll and download information from the deployment server.

When the UF polls the deployment server, it supplies only its identifying information (GUID, etc) and maybe the hashes for its apps. (I am not exactly sure whether the client or the server does the hash comparison.) You cannot customize the info that the UF supplies to the deployment server.

You can put anything that you want in the apps that the UF downloads from the deployment server. The apps must follow the structure for regular Splunk apps.

Bottom line is "no." I don't believe that there is any way to do this.

Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...