Log tag recolection

[TecDiver]

Hi,

I´m new with Splunk and i´m trying to do to enable a tag on splunk recolection to know from which heavy/indexer is coming each log source but i don´t know how to do or approach.

Thank you for your help. Regards.

[scelikok]

Hi @TecDiver,

You can add metadata using  "_meta" in your inputs.conf on UF or Heavy Forwarders (wherever inputs.conf is defined). You have to use default, WinEventLog and perfmon stanzas, since windows and perfmon inputs are not using default stanza for metadata. 

inputs.conf

[default]
_meta = host_forwarder::myHostName

[WinEventLog]
_meta = host_forwarder::myHostName

[perfmon]
_meta = host_forwarder::myHostName

In order to be able to use this new field on your searches you should also add below setting in your search heads fields.conf.

fields.conf
[host_forwarder]
INDEXED=true

[TecDiver]

We have tested but on 7.3.0 it´s not working for us.

We haven´t solved yet.

Thank you for your support.