Splunk Search

How can I add metadata to events at the forwarder?

rphillips_splk
Splunk Employee
Splunk Employee

I'd like to add metadata to my events at the source and change the _meta value periodically without restarting the forwarders.

0 Karma
1 Solution

rphillips_splk
Splunk Employee
Splunk Employee

forwarder:
inputs.conf
[monitor::///var/logs]
_meta = foo:bar

foo represents field name , bar represents field value

indexers:
fields.conf
[foo]
INDEXED = true

I also want to update the metadata value periodically without restarting Splunk on the forwarders.

$SPLUNK_HOME/bin
./splunk _internal call /services/data/inputs/monitor/_reload -auth admin:changeme

View solution in original post

0 Karma

rphillips_splk
Splunk Employee
Splunk Employee

forwarder:
inputs.conf
[monitor::///var/logs]
_meta = foo:bar

foo represents field name , bar represents field value

indexers:
fields.conf
[foo]
INDEXED = true

I also want to update the metadata value periodically without restarting Splunk on the forwarders.

$SPLUNK_HOME/bin
./splunk _internal call /services/data/inputs/monitor/_reload -auth admin:changeme

0 Karma

gravesb
Engager

In case anyone else runs across this, the proper syntax in the inputs.conf is
_meta = foo::bar
two colons between the key and value instead of one.

Get Updates on the Splunk Community!

Index This | A sphere has three, a circle has two, and a point has zero. What is it?

September 2023 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...