Deployment Architecture

How to add custom filed to input.config,Hoe to add custom field to input.config

moradato
Engager

Hello

I have 3 servers (one for each env) , each of the server forward data to the same index. I want to create a search that filter event according to the custom field that in this case represents the environment (prod/test/dev). I found in the documentation that I can override host, source and sourcetype, but I do not want to override, I want to add new information.

Appreciate your answers,
Thanks,Hi all

I am trying to add a custom field to the forwarder and the field need to be searchable. I found that I can only override host, index source and sourcetype and I don't want to override them
My motivation is that I have data from 3 environments (i.e. 3 different forwarders) going to the same index, I want to create a search using the custom field to filter event according to the environment

How can I add a custom field to input.config?

Appreciate your answers
Thanks

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@moradato, if you have three different servers sending data, then by searching with host= should be enough for you to filter the environment. Is there any specific reason you want to have a different field? If you are looking for readability, then create a field in search using eval env=case(host="your dev machine","dev",....etc)

Happy Splunking!
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...