How can I add metadata to events at the forwarder?

[rphillips_splk]

I'd like to add metadata to my events at the source and change the _meta value periodically without restarting the forwarders.

[rphillips_splk · Accepted solution]

forwarder:
inputs.conf
[monitor::///var/logs]
_meta = foo:bar

foo represents field name , bar represents field value

indexers:
fields.conf
[foo]
INDEXED = true

I also want to update the metadata value periodically without restarting Splunk on the forwarders.

$SPLUNK_HOME/bin
./splunk _internal call /services/data/inputs/monitor/_reload -auth admin:changeme

[michaelissartel]

Hi @rphillips_splk where can I find the doc for commands like ./splunk _internal call /services/data/inputs/monitor/_reload -auth admin:changeme

Can I do a post whit it ?

[michaelissartel]

Hi @rphillips_splk 

bar can be an environment variable ?

thanks

[PickleRick]

No. The only "variable" (runtime-determined) parts of the config are those explicitly defined as such in specs.

For example - serverName parameter in [general] section of server.conf. The specs say that it can contain environment variables so it can be dynamically set. For other parameters you define constant values.

[rphillips_splk]

@michaelissartel I haven't tested using an env variable as the field value before. If you do end up testing can you put your reply here for others?

[michaelissartel]

Hi, this solution has been cancelled  😕

[gravesb]

In case anyone else runs across this, the proper syntax in the inputs.conf is
_meta = foo::bar
two colons between the key and value instead of one.