Splunk HTTP Event Collector support for custom metadata(tags) fields/routing fields.

[hrawat]

Splunk version 9.0.8/9.1.3/9.2.x and above has added capability to process key value pairs that will be added at index time on all events flowing through the input. 

Now it's possible to "tag" all data coming into a particular HEC token. HEC will support all present and future inputs.conf.spec configs(_meta/TCP_ROUTING/SYSLOG_ROUTING/queue etc.).

[PickleRick]

So if I understand that correctly, all the typical config items applicable to inputs are now available at separate HEC tokens level, right?

[richgalloway]

Thanks, @hrawat .  What tags are available?  Where can we find out more information about this feature?

[hrawat]

Now it matches what document says

# GENERAL SETTINGS:
# The following settings are valid for all input types (except file system
# change monitor, which is described in a separate section in this file).

[hrawat]

These two sections of inputs.conf( whatever is applicable for monitor/splunktcpin/tcpin etc.)

############################################################################
# GENERAL SETTINGS:
# The following settings are valid for all input types (except file system
# change monitor, which is described in a separate section in this file).
# You must first enter a stanza header in square brackets, specifying the input
# type. See later in this file for examples. Then, use any of the
# following settings.
#
# To specify global settings for Windows Event Log inputs, place them in
# the [WinEventLog] global stanza as well as the [default] stanza.
############################################################################

############################################################################
# This section contains options for routing data using inputs.conf rather than
# outputs.conf.
#
# NOTE: Concerning routing via inputs.conf:
# This is a simplified set of routing options you can use as data comes in.
# For more flexible options or details on configuring required or optional
# settings, see outputs.conf.spec.
############################################################################

[gjanders]

In the past I've used outputgroup = <string> on the inputs.conf of [http] stanzas

It sounds like the versions mentioned (and newer versions) now support:
_TCP_ROUTING

_meta

And a few other settings, is that correct?

It is nice to have the product match it's spec file documentation 🙂

Thanks

[hrawat]

Yes, HEC input stanza will honor all routing fields.

_TCP_ROUTING/_SYSLOG_ROUTING/_INDEX_AND_FORWARD_ROUTING 

Also other fields as per inputs.conf.spec. outputgroup internally maps to _TCP_ROUTING value. But _TCP_ROUTING is multi-value field. You can set multiple output groups.