Getting Data In

MetaData Values: Is there a difference between DEST_KEY = _MetaData:Index versus DEST_KEY = MetaData:Index?

Murali2888
Communicator

Is there any difference between the two below?

DEST_KEY = _MetaData:Index
DEST_KEY = MetaData:Index

Also, I would like to understand why the host, source, and sourcetype values are shown as MetaData:Host, whereas the index shows _MetaData:Index

Thanks for your help.

Regards
Murali

saurabh_tek11
Communicator

@Murali2888, DEST_KEY = MetaData:Index would be incorrect. Have a look on KEYS of transform.conf

Correct syntax as per splunk is _MetaData:Index, it defines the alternate index where the event shall be stored.

KEYs are case sensitive. NOTE: Any KEY (field name) prefixed by '_' is not indexed by Splunk, in general.

saurabh_tek11
Communicator

@Murali2888 hope this helps.

0 Karma

lguinn2
Legend

YES! There is a difference. Keys must be typed exactly as specified. The transform will not work otherwise.

I don't know why there is a difference between the keys that start with an underscore ( _ ) and those that do not. There is nothing in the documentation about that. My guess is that the difference is that the _ is used for metadata fields that are not stored in the journaled rawdata. Even if I am right, there is nothing that you or I can do about it, anyway; some keys start with _ and some don't!

Murali2888
Communicator

Thanks Iguinn for your comments.

There is no clear documentation available as to which keys need to be prefixed by ( _ ). I was hoping somebody would have some idea around this.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...