Getting Data In

can I pass additional source info from inputs.conf

jangid
Builder

Is it possible to pass extra info from inputs.conf?

e.g. [inputs.conf]

[default]
host = my_host

[monitor://somepath]
sourcetype = my_source
additional_info = my_additional_info

I want this additional info from all the forwarder, due to some reason I can not use host name.

Thanks

Tags (1)
0 Karma

sunrise
Contributor

You need to set custom fields. Reference below URL.
But this is not recommended by Splunk.
http://docs.splunk.com/Documentation/Splunk/5.0.3/Data/Configureindex-timefieldextraction

Generally you should use custom fields at search time, editing props.conf or transforms.conf.
http://docs.splunk.com/Documentation/Splunk/5.0.3/Knowledge/Addfieldsatsearchtime

0 Karma

jangid
Builder

this is my custom information. I want to add this information along with sourcetype and is should be searchable. similar to sourcetype, source and host.

0 Karma

linu1988
Champion

From the splunk documentation there is no additional parameters can be passed. But what is the difference between the sourcetype and additional_info? it's the same if we use in search.

0 Karma
Get Updates on the Splunk Community!

New Release | Splunk Cloud Platform 10.1.2507

Hello Splunk Community!We are thrilled to announce the General Availability of Splunk Cloud Platform 10.1.2507 ...

🌟 From Audit Chaos to Clarity: Welcoming Audit Trail v2

🗣 You Spoke, We Listened  Audit Trail v2 wasn’t written in isolation—it was shaped by your voices.  In ...

Splunk New Course Releases for a Changing World

Every day, the world feels like it’s moving faster with new technological breakthroughs, AI innovation, and ...