Splunk dynamically manage _metadata SAI

Splunk Enterprise

Hey,

We look for an elegant way to set _meta field in inputs.conf of SAI application [splunk app for infrastructure]

We now have the following line in inputs.conf of the SAI application

_meta = os::'windows server 2016' os_version::10.0.14393 ip:'10.0.0.1'

We are looking for a way to set up this line automatically when running

splunk reload deploy server

Any suggestions?

Get Updates on the Splunk Community!

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...