The O11y-metadata-updater app makes it easy to attach metadata from Splunk Core onto dimensions in Splunk Observability Cloud. Simple write the search to gather the data you want to attach, add the O11y-metadata-updater alert action and select a field join on. All columns inside the search results (except join field) will then be attached via the SignalFx API.