Assign metadata to events dynamically

Assign metadata to events dynamically

Dynamically assign metadata to files as they are being consumed by Splunk. Use this feature to specify source type, host, or other metadata dynamically for for incoming data.

Important: This feature is supported for use with batch (one time upload) inputs only. Splunk does not recommend using dynamic metadata assignment with ongoing monitoring (tail) inputs. For more information about file inputs, refer to Monitor files and directories in this manual.

Append a single dynamic input header to your file and specify the metadata fields you'd like. You can see the available pipeline metadata fields in transforms.conf.spec.

You can use this method to assign metadata instead of editing inputs.conf, props.conf and transforms.conf.

Configuration

Edit a data file to add a single dynamic input header.

• Add the following header to the file to be indexed:

***SPLUNK*** $ATTR1=$VAL1 $ATTR2=$VAL2 etc.

• Set $ATTR1=$VAL1 to the values you wish. For example, set sourcetype=log4j host=swan.
• Add a single header anywhere in your file. Any data following the header will be appended with the attributes and values you assign until the end of the file is reached.
• Add your file to $SPLUNK_HOME/var/spool/splunk or any other directory being monitored by Splunk.

Set values with a script

Write a script to automatically add a dynamic input header to your incoming data streams. Your script can also set attributes dynamically based on the contents of your file.