Dynamic metadata assignment

Dynamic metadata assignment

Dynamically assign metadata to files as they are being consumed by Splunk. Append the dynamic input header to your file and set any metadata fields you'd like. You can see the available pipeline metadata fields in transforms.conf.spec.

Use this feature for any incoming data streams that might have different sourcetypes, hosts or other metadata that you would like to indicate dynamically. Set any metadata in this manner, as opposed to using inputs.conf, props.conf and transforms.conf.

Configuration

Edit any file to add the dynamic input header.

• Add the following header to your file:

***SPLUNK*** $ATTR1=$VAL1 $ATTR2=$VAL2 etc

• Set $ATTR1=$VAL1 to the values you wish.
  • For example, set sourcetype=log4j host=swan.
• Add the header anywhere in your file
  • Note: Any data following the header will be appended with the attributes and values you assign until the end of the file is reached.
• Add your file to $SPLUNK_HOME/var/spool/splunk or any other directory being monitored by Splunk.

Set values with a script

Write a script to automatically add the dynamic input header to your incoming data streams. Your script can also set attributes dynamically based on the contents of your file.

For example, Splunk's report caching script takes an index as a variable and automatically assigns that index to incoming data streams.