Best way to set host key in Modular Inputs

[bmacias84]

I am building a Modular Input but would like to set the host behind the scene. I know that I can use Scheme Default but that sets the default for all stanza.

[poll://Server1]

port=4532

comString=helloworld

id=1.23.22.15.3

#I want the value of poll to automagicly set value for host when the user goes through the Manager.

host=Server1

I know I could use a transform to set the Server1 host value during indexing, but there is got to be a better way with modular inputs. I don't want the user to retype Server1 Manager screen.

How would I accomplish this with the <manager>.xml, in a introspection, or in my .py script?

[Simon · Accepted solution]

You could use XML streaming mode (http://docs.splunk.com/Documentation/Splunk/latest/AdvancedDev/ModInputsStream) and then set the host value on each event in your python script, for example:

print "<stream><event><data>09/08/2011 14:01:59.0398 event_status="(0)The operation completed successfully."</data><host>yourhost</host></event></stream>"

You can get the stanza name by parsing the input configuration (http://docs.splunk.com/Documentation/Splunk/latest/AdvancedDev/ModInputsScripts see "Example code reading XML configuration") and use this value in the host attribute.

[Simon]

Of course you can use the host key from inputs.conf by parsing the XML. See an example here:
http://docs.splunk.com/Documentation/Splunk/latest/AdvancedDev/ModInputsExample

After parsing the XML, just replace

<host>yourhost</host>

from my streaming sample above to something like

print "<stream><event><data>09/08/2011 14:01:59.0398 event_status="(0)The operation completed successfully."</data>%s</host></event></stream>" % config['host']

[bmacias84]

I was hoping to set the create the host key parsing by the XML feed from the Inputs Manager and place it in the inputs.conf.