Splunk Dev

UF to send both Hostname and IP Address as metadata. Currently either IP or hostname is supported as host field


We can have either IP address or hostname for host field, both is not supported yet. Below highlighted config in inputs.conf will force to set host as IP address:

host = localhost

connection_host = ip

we tried to explore _meta field coming from UF. If we can make that dynamic to support variable, then we can have both IP and hostname.

This would be similar to $decideOnStartup functionality for host field, but more flexible.

Has anyone able to send both IP and Hostname dynamically for indexing through UF?

For example:

$hostname$ will yield hostname.. as used with inputs.conf, it would be


_meta = splunk_forwarder::$hostname$

Labels (1)
Tags (1)
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...