Dynamic metadata assignment

Dynamic metadata assignment

You can dynamically assign metadata to files as they are being consumed by Splunk. Simply append the dynamic input header to your file and add whatever metadata you'd like.

Use this feature for any incoming data streams that might have different sourcetypes, hosts or other metadata that you would like to indicate dynamically. You can set any metadata in this manner, as opposed to using inputs.conf, props.conf and transforms.conf.

Configuration

You can easily edit any file to add the dynamic input header. Here's how:

• Add the following header to your file:

*** SPLUNK *** $ATTR1=$VAL1, $ATTR2=$VAL2, etc

• Set $ATTR1=$VAL1 to the values you wish.
  • For example, you can set sourcetype=log4j, host=swan.
• You can add the header anywhere in your file
  • Please note: any data following the header will be appended with the attributes and values you assign until the end of the file is reached.
• Add your file to $SPLUNK_HOME/var/spool/splunk or any other directory being monitored by Splunk.

Set values with a script

You can write a script to automatically add the dynamic input header to your incoming data streams. Your script can also set attributes dynamically based on the contents of your file.

For example, Splunk's report caching script takes an index as a variable and automatically assigns that index to incoming data streams.

• Was this topic useful?
• Post a comment