How to identify data from different sites

[justinrichter]

Given multiple locations with Splunk heavies or edge processors, is there a way at the heavy or edge processor to add a tag or some other relevant piece of identifying information that would identify the site that data came from? I would like to send data from various locations to a single set of indexers and be able to identify where that came from without having to use something like the assets lookup to figure it out.

[livehybrid · Accepted solution]

Hi @justinrichter 

The easiest way to achieve this is to set an index-time field on each host that applies to all sourcetypes, such as:

# props.conf
[default]
TRANSFORMS-setSourceMeta = setSourceMeta
or
RULESET-setSourceMeta = setSourceMeta

# transforms
[setSourceMeta]
#Update field/value name accordingly.
INGEST_EVAL = travelledVia=ThisHostName

With Edge Processor you can apply a similar approach by using eval to set an index-time field which will be stored for each event.

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[PickleRick]

1. Use ruleset instead of transform. Transform won't fire on already parsed data (coming from HF, SH, DS...)

2. If you're using INGEST_EVAL you can use splunk_server value - you don't have to explicitly set the value.

[richgalloway]

Splunk has a host field that identifies the sending server, but there is nothing built-in that identifies the source location (site, IP, etc).  You would need to add fields to include that information.  Use INGEST_EVAL in transforms.conf to do that.