Splunk Search

Adding host attributes (fields?) at index time

kbutlerhc1
Engager

New to splunk, so bear with me.

As I'm setting it up in our environment, we are forwarding logs from multiple "environments" (think prod, qa, stage, etc). What I would like to do is at the host level, define what environment it comes from so that searches are easily filterable. env="prod" for example

According to this article, it seems "not recommended" to do what I want to do. http://docs.splunk.com/Documentation/Splunk/6.2.1/Data/Configureindex-timefieldextraction

Am I looking in the right place? What's the proper way to do this?

Tags (3)
0 Karma

gfuente
Motivator

The proper way to do this is by using tags

And set up them accordingly, for example

host=dev1 tag -> DEV

This way you can change it any time, as this is appliedon search time

Regards

0 Karma

kbutlerhc1
Engager

Can this be done in a configuration file on the host itself? I'd like to configure all of this through Ansible in our splunk role. Similar to the inputs.conf.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Introduction to Splunk AI

How are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. Lucky for ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Maximizing the Value of Splunk ES 8.x

Splunk Enterprise Security (ES) continues to be a leader in the Gartner Magic Quadrant, reflecting its pivotal ...