Getting Data In

Use hostname variables in index_time EVAL

season88481
Contributor

Hi everyone,

I am trying to add a custom field on every events that coming from a Heavy-Forwarder, so that from search I can know which HF the evnets are going thru.

Here is my configuration in a HF:
props.conf:

[default]
TRANSFORMS-addHF = addHF

transforms.conf:

[addHF]
INGEST_EVAL = hf="my-hf-01"

fields.conf:

[hf]
INDEXED=true

So instead of hardcoding the hostname for every HF, I am trying to find a way to use an OS variable such as hostname in the INGEST_EVAL.

Any idea how to achieve this?

Many thanks.
S

Get Updates on the Splunk Community!

Splunk ITSI & Correlated Network Visibility

  Now On Demand   Take Your Network Visibility to the Next Level In today’s complex IT environments, ...

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

  Now On Demand  Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research ...

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...