Can you expose an env variable as a field in events coming from that forwarder

[stath002]

I am trying to expose an environment variable and make it a field for events coming from a splunk universal forwarder.

We are trying to get Amazon stack name as field that can be searched for in events. It is not currently logged but it is available as a env variable. Is there a way to easily add this env variable to events that are coming from AWS hosts via a universal forwarder? We want to be able to search: index=some_index sourcetype=all_sourcetypes_for_this_index <some env_var>=foo where <some_env_var>=foo is coming from the linux system variable

I looked at doing an indexed field extraction but it still looks like that needs to come from a log file. If not I am not seeing how to basically index a field at index time using the env variable.

[sloshburch · Accepted solution]

You'd have to do a transforms to rewrite the raw data BUT I strongly recommend against that. There are so many reasons not to muck with the data itself.

Instead, I'd recommend using an automatic lookup. The result sounds the same: anytime you search on that host, splunk will add a field (not in the raw, but in the field list) of the stack name you want. You'd likely want to use the AWS Add On to easily fetch those stack names and then simply push those details into a csv periodically (scheduled search with outputlookup).

[stath002]

I had considered doing it this way too but did not know about the AWS add-on and was unsure of how to keep the csv up current. Thanks!!!