Splunk Search

Adding host attributes (fields?) at index time

kbutlerhc1
Engager

New to splunk, so bear with me.

As I'm setting it up in our environment, we are forwarding logs from multiple "environments" (think prod, qa, stage, etc). What I would like to do is at the host level, define what environment it comes from so that searches are easily filterable. env="prod" for example

According to this article, it seems "not recommended" to do what I want to do. http://docs.splunk.com/Documentation/Splunk/6.2.1/Data/Configureindex-timefieldextraction

Am I looking in the right place? What's the proper way to do this?

Tags (3)
0 Karma

gfuente
Motivator

The proper way to do this is by using tags

And set up them accordingly, for example

host=dev1 tag -> DEV

This way you can change it any time, as this is appliedon search time

Regards

0 Karma

kbutlerhc1
Engager

Can this be done in a configuration file on the host itself? I'd like to configure all of this through Ansible in our splunk role. Similar to the inputs.conf.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...

Introduction to Splunk AI

How are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. Lucky for ...