Questions in topic: "_meta" The latest questions for the topic "_meta" TcpInputProc - Encountered S2S Exception=Invalid _meta atom: for key="Caption": Hi I get al lot of the following messages on my IX: TcpInputProc - Encountered S2S Exception=Invalid _meta atom: for key="Caption": Can anyone explain what this error messages indicate? splunk-enterprise _meta tcpinputproc Wed, 11 Sep 2019 09:38:55 GMT aagehh Matching log events with dynamic context information (e.g which version of package X was installed?) Hi everyone, I am using Splunk Enterprise with the Universal Forwarder 6.5.2/6.5.3 on multiple hosts running Ubuntu 14.04 LTS or 16.04 LTS, and I am trying to find a way to tie the versions of specific debians installed on these hosts to the generated log events for specific sourcetypes. Example: assuming I configured Splunk so that all log lines for sourcetype `mysourcetype` are generated by programs installed by the `mydebian` debian package, I'd like to know for each log event on `mysourcetype` which version of the `mydebian` package was installed on the host *when this log event was created*. This would help me among other things to correlate the occurrences of various events to the versions of software installed on the hosts ("Did failure X occur more on v2.3 than on v1.5?") Note that I only need to tie log events <> package versions on splunkcloud when doing searches there, I don't technically need this association at index time on the hosts. With a bit of research on these forums I found the `_meta` 'tag' for `inputs.conf` that I can use to attach key/value pairs to log events in the form `_meta = field1::foo field2::bar` ( ), but 1) I understand that tying these metadata directly on the hosts (index time) would increase the size of every ingested message and most of the time ingest the same information (these package versions might change every few days at most), 2) I think I understand how `_meta` can be used with extracted fields, but not how I would use it with, say, the output of a shell command ( `dpkg [...]` ) Retrieving these package versions and the timestamps of when they changed is fairly easy to do with our splunk set up, so I am thinking of an alternative to `_meta` where I would create some temporal look up table (easy) in the form: mydebian_installation_time,host,mydebian_version_installed 2018-11-13 13:10:05.908,host1,2.3.4 2018-12-18 19:26:45.000,host1,2.3.5 2018-12-31 21:03:03.000,host2,1.2 [...] And then tie the corresponding package version to each log events in `mysourcetype`. Ideally I'd only have to do this association once, and maybe update it periodically, but not with every single search. I haven't found how to do this last part though (tying info from a temporal look up table to log events), so I am looking for pointers there too. Thanks splunk-enterprise lookup time-based _meta contextual Sun, 05 May 2019 17:31:21 GMT almin Added _meta to default result in double counts. unable to search data using SPL index=test ssp=3538 following search does return the result index=test ssp=*3538 To resolve the issue implemented Fields.conf [ssp] INDEXED = True After adding to Fields.conf we could search using >>>index=agcy-dns ssp=3538 We noticed that field ssp case giving a double count. _meta double-quote Fri, 08 Mar 2019 01:00:08 GMT rbal_splunk _meta not getting expected logs to splunk Hello, we have index "text-index" and region is passed as meta _meta = region::east sourcetype = testlogs when i query index="text-index" sourcetype=testlogs i see all the logs displayed. when i use index="text-index" sourcetype=testlogs region="*" i see all the logs displayed but when i use index="text-index" sourcetype=testlogs region="east" it will display the logs only which has word east. its supposed list all the like other two queries above. why does it gives me only if words match. please correct me if i'm doing anything wrong splunk-enterprise _meta Mon, 04 Feb 2019 21:57:23 GMT rajpalyalla Is it possible to treat a _meta field as a non-indexed field? I have seen conflicting answers on this and am confused about what should and shouldn't work. In `inputs.conf` on our forwarders we configure the following (as an example): [default] _meta=environment::production cluster:: region::ap-southeast-2 role::logging subrole:: instance_type::t2.large On the IX/SH we configure the following in `fields.conf` (snippet): [environment] INDEXED = False INDEXED_VALUE = False [cluster] INDEXED = False INDEXED_VALUE = False [region] INDEXED = False INDEXED_VALUE = False The docs lead me to believe that by specifying `INDEXED = False`, the field would not be treated as an indexed value. But no matter what combination of values in fields.conf, I get the following behaviour in searches: environment=production ==> 0 results environment::production ==> all results matching that meta tag environment="*production*" --> all results matching that meta tag, + some spurious matches of production in the raw text The reason this is important is because non-technical users use the interface to try and drill down on search results, and find no end of frustrating where clicking on the auto-extracted interesting or selected fields on the left, selecting for example the `production` value for `cluster`, which appends `cluster=production` to the search, and immediately yields no results. What I want to know is how can I get meta fields to simply be treated as a regular non-indexed field? field fields _meta Mon, 04 Feb 2019 19:24:26 GMT jonow what is _meta in DEST_KEY field in transforms.conf and what it does and where it reflects and when we are writing _meta in DEST_KEY filed then we have to write $0 at start in FORMAT so what it means and why we have to do so? i made whole transforms.conf and prop.conf for a data in splunk and analyse FORMAT in transform.conf with $0 and without it but nothing changes had reflected props.conf transforms.conf _meta dest_key Tue, 25 Dec 2018 08:38:33 GMT dtk Need some clarification on search-time _meta field extraction. I have got a question about using _meta fields in the /opt/splunkforwarder/etc/system/local/inputs.conf of a Splunk Universal Forwarder (deployed on an AWS EC2 Instance) In our inputs.conf of the Splunk Universal Forwarder in developement we use one _meta field, `vendor`, e.g. [default] host = $decideOnStartup _meta = vendor::devops In our organization the Indexers and Search Heads are managed by a dedicated tooling team. I did NOT requested the tooling team to update The fields.conf on the Search Head with e.g. the following statements [vendor] INDEXED=true; If I execute the following search in the Search & Reporting Splunk App index=os host="" I see in Selected Fields the following fields, `host`, `source`, `sourcetype` and `vendor`. The default fields host, source and sourcetype are index time extracted fields, but I don’t understand how the vendor field is extracted by Splunk because the fields.conf on the Search Head was not updated yet. Can anybody explain why the `vendor` _meta field is automatically extracted when I execute the search *index=os host=""*, without updating the fields.conf in the Search Head. I also noticed that the following search index=os host="” vendor=devops gives no result, but if I change the search to this index=os host="” vendor::devops I get the same result set as the search *index=os host=""* splunk-enterprise search inputs.conf _meta fields.conf Thu, 22 Nov 2018 07:38:04 GMT AndreAtNN _meta fields: why am I unable to search for all of the events? I am not able to search for all of the events from the fields. When i try field::value , I can see all of the events. But with field=value , only some of the events are searchable. updated my fields.conf with [field] INDEXED = true , but do i also need to update my inputs.conf with the fields and its values? There are going to be more values for the fields, and it can be hard to update all of them? splunk _meta fields.conf Fri, 07 Sep 2018 18:45:18 GMT godman Distinguish which Heavy Forwarder an event passed through? Hello, I've been looking through documentation and other answers, and would like some ideas on our specific use case. Essentially, we have 1 Search Head, 1 Indexer, a dozen Heavy Forwarders, and each Heavy Forwarder has an arbitrary and continuously changing number of UFs sending them data. All running 6.7.7. We are in a situation where we would like to deploy conf files to heavy forwarders/indexer/search head as needed, so we can identify which heavy forwarder each event has passed through. Ideally we would do this without affecting the current parsing happening to the events, which means I'm not comfortable altering the _raw (as I've seen mentioned in some answers) by appending information to the _raw at the Heavy Forwarders, and then extracting the field at index time onto indexers, or search time at search heads. Looking at suggestions on this post, I have a couple questions: What would adding this to inputs.conf on a Heavy Forwarder do for us? Is this useful? [default] disabled = 0 _meta = Terminal::1 Perhaps instead something like, on the Heavy Forwarder inputs.conf: [default] location = mylocation then on Indexer, props.conf: [default] TRANSFORMS-location = addlocation and transforms.conf: [addlocation] SOURCE_KEY = location REGEX = (.*) FORMAT = location::$1 WRITE_META = true Any insight and advice is greatly appreciated. Thank you! heavy-forwarder tags default _meta Fri, 06 Jul 2018 15:43:19 GMT adamsmith47 Extremely confused with :: vs = On our forwarders we have a `[default]` `_meta` value that specify a few `key::value` pairs, e.g. a key to tell us what site this server forwarding the data belongs to (e.g. `site::staging`). When I search for `site=staging` I get fewer results than with `site::staging`, and I can't seem to find relevant documentation that explains why and it isn't easy to determine _what_ is actually being filtered in the first compared to the latter when I look at the results (no easy/logical at-a-glance answer). If I take a specific host and a simple file we monitor, like `host=someserver source=/var/log/messages` - the result set is vastly different, with `site::staging` containing what seems to be the entire log and `site=staging` giving just a few lines from the log (and those lines don't contain text which mention `staging` either). I can't think of any logic that would dictate why just a few lines seem to match `site=staging` - I'd expect that field to either be searchable or not, not some odd subset of data. Also the UI highlights the `source` field in the events as matching `staging` when I do `site::staging` which points to it thinking that it knows what I want. This makes it even more annoying when using the UI to add a field to the search, because when you click the `site` field and "add to search" it adds it as `site=staging` which doesn't yield all the results. This is with SplunkCloud if that makes any difference. splunk-cloud _meta Tue, 05 Jun 2018 03:21:04 GMT Kindred Need some more clarification on _meta value while using. Hi Folks, we have ingested the logs from microsoft azure using microsoft cloud services app on HF and we added some custom field in data input(inputs.conf) _meta=account_name::mscdes01 as that field is not present in raw logs. also added fields.conf on both indexer and search head and able to see the account_name field in the logs and looks good. fields.conf- [account_name] INDEXED = true Here i have couple of questions. 1. will it create any performance issue if we using _meta option on HF. 2. can i create fields.conf file on HF instead creating on indexer & SH. will it index the field if i create on HF. 3. why we are creating fields.conf on IDX and SH to extract that field. _meta Tue, 22 May 2018 06:53:54 GMT lksridhar How to add _meta to all entries from forwarder? We have couple development environments that have Windows servers with same names (i.e. HOSTNAME1) and would like to add meta "env" to every log file sent from local forwarder to splunk server. I can achieve this by adding `"_meta = env::env01" to every log type in inputs.conf i.e.:` [WinEventLog://Application] _meta = env::env01 [WinEventLog://Security] _meta = env::env01 BUT I when I try to add it to [default] at the top of `inputs.conf`, to save repeating `_meta=env01` for every log type, nothing happens, i.e.: [default] host = HOSTNAME _meta = env::env01 host= gets applied, but _meta doesn't. What am I doing wrong? How could I achieve apply meta to every entry going out of server, if [default] is not supported? splunk-enterprise forwarder _meta Fri, 26 Jan 2018 22:10:51 GMT mestuleslv How do I add a dynamic _meta field pushed from deployment server to monitored files on Heavy Fowarders? I am working with a heavy forwarder tier that is running syslog where network devices are sending data. For ease of tracking where each file is being monitored from, I would like to add some metadata to the monitored files, that includes the heavy forwarder they are being collected from (this tier is load balanced so the data could land on any number of hosts). I have tried adding _meta = heavy_forwarder::$HOSTNAME and that does not appear to be doing the trick - It actually just puts $HOSTNAME as the value. Example monitoring stanza: [monitor:///var/log/remote/my_network_device] index = network sourcetype = mysourcetype ignoreOlderThan = 1d disabled = false host_segment = 4 blacklist = \.(gz|tgz|xz|\d{1})$ _meta = heavy_forwarder::$HOSTNAME I have also tried to add _meta = heavy_forwarder::$HOSTNAME to the [default] stanza and it has the same results. I know I can hardcode the hostname in system/local/ - I just am trying to think of a much less manual solution to handle dynamic scaling of the HF tier. Any help would be greatly appreciated. splunk-enterprise file-monitoring _meta Thu, 19 Oct 2017 17:00:53 GMT ShaneNewman I want to add metadata to events from forwarder via JSON file We have events coming from hosts that need to have additional information added to them from two configuration files. One file is a plain text file which contains a label for the set of hosts this particular host belongs to. The second file is JSON which contains meta-data about the configuration of these hosts based upon which label is in the first configuration file. This meta-data is information like the source of a data stream the hosts are handling and the destination the data stream is being sent as well as information about the data input rate and related information. When debugging the system these hosts are a part of this information is essential so that we can understand what part of the system they function as. The problem is that _meta in the forwarder inputs.conf file seems to only support very simple single key -> value pairs. What we need though is more complex hash with nested keys and their associated values. Can _meta handle this? If so what would the inputs.conf file look like then? If not, then how can I add/decorate this meta-data which is crucial for understanding our system to the events? splunk-enterprise inputs.conf json metadata _meta Tue, 19 Sep 2017 00:00:10 GMT scottj1y Why is a search for fields added with _meta in inputs.conf not returning any results? Hello, We added several fields with the _meta keyword in inputs.conf. When we search for the fields with "field::value" it is working, but when using "field=value" instead, there are no results. We already added the new fields in fields.conf with "INDEXED=true" and "INDEXED_VALUE = false" options on our Search Heads, or is it needed to adapt the fields.conf settings on the Indexers as well? Is there anything else to keep in mind? Thanks, Rainer splunk-enterprise search inputs.conf _meta fields.conf Mon, 11 Apr 2016 14:24:22 GMT rainerzufall How to add _meta Tags to modular inputs, i.e. Netapp Ontap App Hello, we would like to add _meta Tags to data collected by the Hydra Scheduler or other modular inputs. For a standard inputs I can use the _meta = key::value format to add additional data, but I heard that this is not supported for modular inputs. Thanks, Mathias splunk-enterprise modular-inputs modular-input _meta ontap Thu, 10 Mar 2016 22:00:13 GMT mspoerr How to configure a universal forwarder to add multiple fields to events being forwarded via _meta? We're trying to find a way to have the universal forwarder send data to the indexer essentially pre-marked with a small number of custom fields (or the like) that we can later search on. For example, a particular computer might be from project-X and be in a environment of test or prod or development. Since VMs come and go, we can't do any persistent mapping of which computer has these added characteristics (host-n.n.n.n might be dev today, prod tomorrow), but the 'data' is persistent. I stumbled across the _meta construct in inputs.conf, which works well enough for 'one' custom field. Just like specifying which index to use, I also specify `_meta = somename::value` in inputs.conf. The question I have is, how could I have 'multiple' such added fields specified by the universal forwarder? I know there is folklore saying doing this on the forwarder side is somehow evil or something, but we're talking about adding under a half-dozen custom fields (?) for all the events coming from the forwarder computer. Any suggestions other than pointers to the impossibly unreadable/abstract/no-examples docs which I've wasted tens of hours on already? splunk-enterprise universal-forwarder inputs.conf _meta Mon, 08 Feb 2016 20:33:53 GMT vinceskahan I added a field to all my events so I could search for specific results, but why can't Splunk read the custom field values? I added a field **cluster** to all my events, so that I can search for results in a Hadoop cluster specified. I edited inputs.conf on each node for example with [default] _meta = cluster::Test8 and fields.conf with [cluster] INDEXED=true The cluster information is displayed fine in Splunk Search: ![alt text][1] If I try to search for a specific cluster, however, I get no results: ![alt text][2] When I search for `cluster=*Test8`, the search works fine again. When I try to plot data (CPU_Load) with timechart and plot it by cluster, it messes up the diagram because it doesn't show any data points. Thanks for your help! [1]: /storage/temp/76238-splunk1.jpg [2]: /storage/temp/76239-splunk-2.jpg splunk-enterprise field custom _meta Wed, 16 Dec 2015 13:29:44 GMT muellernc Extra indexed field in _meta require * in search query Hi, I have an inputs.conf as below in my UniversalForwarder [monitor::///private/var/log/system.log] _meta = serial_number::"ABC123456" disabled = False index = core sourcetype = osx_syslog Events are pushed nicely and search works well except for one minor issue. To search by serial numbers, I have to do index=core serial_number::ABC123456 or index=core serial_number=*ABC123456* However I wish to be able to search as such index=core serial_number=ABC123456 I would be grateful if you could help me figure out what additional configuration stanzas might be needed and hopefully this can be set on the SplunkForwarder end. Thank you for your help! Jean-Matthieu fields search-help indexed _meta Thu, 22 Jan 2015 11:42:55 GMT jeanmatthieu JSON, TCP Input and _meta Hi! I'm sending a JSON document to a TCP Data Input on my Splunk server. I noticed the magical field _time that allows me to set the time stamp the event occurred on and was hoping I could use _meta to add fields to be indexed automatically. For example, is there a way to extract 'computer' and 'browser' fields from the below JSON automatically ? { "_meta": "computer::MacBook Pro browser::Safari", "_time":"2014-10-24'T'11:59:01'Z'", } Thank you for your help, Jean-Matthieu json _time _meta Fri, 24 Oct 2014 12:19:48 GMT jeanmatthieu