Splunk Search

Search gives no hits for my _meta added fields

ahattrell_splun
Splunk Employee
Splunk Employee

When adding an _meta entry into inputs.conf such as:

[monitor:///tmp/fwdtest]
sourcetype = sun_jvm
_meta env::prd

Whilst the field will show up when inspecting events, a search for env=prd does not return any results.

Searching for env::prd does return results as expected - though this is a deprecated approach.

Tags (2)
0 Karma
1 Solution

ahattrell_splun
Splunk Employee
Splunk Employee

This can be solved by creating a appropriate entry in fields.conf on the indexer.

I used the following stansa:

[env]
INDEXED=true

View solution in original post

tpaulsen
Contributor

Can the value of the _meta entry be from another file?

0 Karma

yannK
Splunk Employee
Splunk Employee

the equal sign was not displayed in the post
_meta = env::prd

0 Karma

ahattrell_splun
Splunk Employee
Splunk Employee

This can be solved by creating a appropriate entry in fields.conf on the indexer.

I used the following stansa:

[env]
INDEXED=true

cramasta
Builder

Are you sure this has to be on the indexer and not the search head? I just tested putting this only on the search head and it looks to be working.

[newfieldname]
INDEXED = True
INDEXED_VALUE = False

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...