Getting Data In

custom fields overriding

gcusello
SplunkTrust
SplunkTrust

Hi at all,
a question before starting a new configuration.

I configured custom fields on some Universal Forwarders using _meta in inputs.conf and it correctly runs.

In my architecture there's an intermediate Forwarder that collects different _meta from Universal Forwarders and it correctly runs.

If now I try to add _meta to some inputs on the Heavy Forwarder itself: in your opinion (and/or experience), must I configure _meta in each input stanza of the Heavy Forwarder or can I configure the [default] stanza without overriding values from the other Universal Forwarders?

Thank you for your attention.

Ciao.

Giuseppe

Tags (2)
0 Karma
Get Updates on the Splunk Community!

Best Strategies to Optimize Observability Costs

 Join us on Tuesday, May 6, 2025, at 11 AM PDT / 2 PM EDT for an insightful session on optimizing ...

Fueling your curiosity with new Splunk ILT and eLearning courses

At Splunk Education, we’re driven by curiosity—both ours and yours! That’s why we’re committed to delivering ...

Splunk AI Assistant for SPL 1.1.0 | Now Personalized to Your Environment for Greater ...

Splunk AI Assistant for SPL has transformed how users interact with Splunk, making it easier than ever to ...