Splunk dynamically manage _metadata SAI

Splunk Enterprise

Hey,

We look for an elegant way to set _meta field in inputs.conf of SAI application [splunk app for infrastructure]

We now have the following line in inputs.conf of the SAI application

_meta = os::'windows server 2016' os_version::10.0.14393 ip:'10.0.0.1'

We are looking for a way to set up this line automatically when running

splunk reload deploy server

Any suggestions?

Get Updates on the Splunk Community!

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious! We’re back with another ...