All Apps and Add-ons

Splunk App/Add-on for AWS: How to add _meta information to AWS Description and Cloudwatch inputs

rainerzufall
Path Finder

Hello,

How can we add custom _meta Tags to AWS Description and Cloudwatch inputs since specialized conf files are used to collect these? I tried to add the _meta command to aws_description_tasks.conf and aws_cloudwatch_logs_tasks.conf, but get an error that this command is not supported.

Thanks,
Rainer

0 Karma
1 Solution

rainerzufall
Path Finder

I found a solution:
The missing input stanzas for Description and Cloudwatch in /local/inputs.conf can be added the following way:

[aws_description://CONFIGURED-DESCRIPTION-INPUT-NAME-IN-GUI]
_meta = tag1::value1 tag2::value2

[aws_cloudwatch_logs:://CONFIGURED-CLOUDWATCH-INPUT-NAME-IN-GUI]
meta = tag1::value1 tag2::value2

View solution in original post

0 Karma

rainerzufall
Path Finder

I found a solution:
The missing input stanzas for Description and Cloudwatch in /local/inputs.conf can be added the following way:

[aws_description://CONFIGURED-DESCRIPTION-INPUT-NAME-IN-GUI]
_meta = tag1::value1 tag2::value2

[aws_cloudwatch_logs:://CONFIGURED-CLOUDWATCH-INPUT-NAME-IN-GUI]
meta = tag1::value1 tag2::value2
0 Karma

vinceskahan
Path Finder

Rainier - that format works in inputs.conf on a universalforwarder for me, just as you wrote it....assuming the tag1 and tag2 fields are known on the server side of course.

0 Karma

rainerzufall
Path Finder

yes, but the mentioned two inputs are not defined in inputs.conf - there are special conf files for them which do not accept _meta

0 Karma

jzhong_splunk
Splunk Employee
Splunk Employee

Hi Rainer, are you talking about the EC2 instance tags you assigned via AWS Management console? They are available in the Config data. The AWS Description or Metadata(on AWS App) are mainly to collect the runtime information of the instances/vpc/securityGroup. You can try enabling the Config data for that region, then all tags will be available in Config JSON files. You can then search by tags.

rainerzufall
Path Finder

thank you for your answer. I would like to add additional custom tags like "_meta = tag1::value1 tag2::value2"...

0 Karma

vinceskahan
Path Finder

absolutely - me too...... I've been trying to find a way to add multiple custom metadata for months. The best I can come up with is one long ugly value that I can tear apart at search time:

_meta = myfields::tag1=value1,tag2=value2,tag3=value3

I'd much better be able to add greater-than-one custom fields at index time....

0 Karma
Get Updates on the Splunk Community!

Security Highlights: September 2022 Newsletter

 September 2022 The Splunk App for Fraud Analytics (SFA) is now Splunk SupportedUse your existing Splunk ...

Platform Highlights | September 2022 Newsletter

 September 2022 What’s New in 9.0 and How to UpgradeGet a walk through of what is new Splunk Enterprise 9.0 ...

Observability Highlights | September 2022 Newsletter

 September 2022 Splunk Observability SuiteAccess to "Classic" SignalFx Interface Will be Removed on Sept 30, ...