Hi,
I have an inputs.conf as below in my UniversalForwarder
[monitor::///private/var/log/system.log]
_meta = serial_number::"ABC123456"
disabled = False
index = core
sourcetype = osx_syslog
Events are pushed nicely and search works well except for one minor issue.
To search by serial numbers, I have to do
index=core serial_number::ABC123456
or
index=core serial_number=*ABC123456*
However I wish to be able to search as such
index=core serial_number=ABC123456
I would be grateful if you could help me figure out what additional configuration stanzas might be needed and hopefully this can be set on the SplunkForwarder end.
Thank you for your help!
Jean-Matthieu
[serial_number]
INDEXED_VALUE=false
Adding stanzas in fields.conf on the indexer help sorting this out
[serial_number]
INDEXED=true
or
[default]
# Apply to all extra _meta indexed field
INDEXED=true
Will there be an impact on search time extracted fields performance to add the default stanza as defined above ?
Thanks!
I tried adding INDEXED=true but that did not work. Any other suggestions?
He meant INDEXED=false