Getting Data In

Use hostname variables in index_time EVAL

season88481
Contributor

Hi everyone,

I am trying to add a custom field on every events that coming from a Heavy-Forwarder, so that from search I can know which HF the evnets are going thru.

Here is my configuration in a HF:
props.conf:

[default]
TRANSFORMS-addHF = addHF

transforms.conf:

[addHF]
INGEST_EVAL = hf="my-hf-01"

fields.conf:

[hf]
INDEXED=true

So instead of hardcoding the hostname for every HF, I am trying to find a way to use an OS variable such as hostname in the INGEST_EVAL.

Any idea how to achieve this?

Many thanks.
S

Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...