Getting Data In

How do I add a dynamic field to an inputs.conf file?

arlington
Explorer

I have logs which are monitored by a Splunk forwarder, but what I want to do is add dynamic fields to an event, which will be generated as a result of any script or command (for example with curl).

I know one way, with scripted input, is to create a script that reads logs and parallel add any value to the result.

Do we have another more elegant way of doing this? I searched but I couldn't find anything.

0 Karma
1 Solution

chrisyounger
SplunkTrust
SplunkTrust

Hi @arlington

The most elegant way to enrich events is to have a script that populates a CSV which is then used as an automatic lookup. A good example is the identity and asset lookups in Enterprise Security that work like this. They are very performant even for huge lookups.

If you want to enrich an event and your absolutly can't pre-compute the data, then use a script (external) lookup https://docs.splunk.com/Documentation/Splunk/7.2.3/Knowledge/Configureexternallookups or a custom command: https://docs.splunk.com/Documentation/Splunk/7.2.3/Search/Writeasearchcommand

All the best.

View solution in original post

chrisyounger
SplunkTrust
SplunkTrust

Hi @arlington

The most elegant way to enrich events is to have a script that populates a CSV which is then used as an automatic lookup. A good example is the identity and asset lookups in Enterprise Security that work like this. They are very performant even for huge lookups.

If you want to enrich an event and your absolutly can't pre-compute the data, then use a script (external) lookup https://docs.splunk.com/Documentation/Splunk/7.2.3/Knowledge/Configureexternallookups or a custom command: https://docs.splunk.com/Documentation/Splunk/7.2.3/Search/Writeasearchcommand

All the best.

arlington
Explorer

Actually what I am trying to do is add Instance ID or any TAG from EC2 instance to my apps event. But still I can't find a proper solution how to do that. Using host field is not reliable to match in lookup, because if instance going to be destroyed it's ip and host name release and will be assigned to newly created instance in future. As Instance ID is unique across whole AWS environmet I would like to use that. But in order to do that need add instance id to all events which I am forwarding with splunkforwarder. Instance ID are accessible with the curl command inside current running instance. Any idea on that?

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...