Getting Data In

How can I configure and set metatada of a dataset using ***SPLUNK*** for batch input?

melonman
Motivator

Hi,

I am having trouble with the use of ***SPLUNK*** sourcetype=xxx for batch input with sinkhole option.

My inputs.conf looks like this:

[batch:///opt/sinkhole]
move_policy = sinkhole

and, the input file is this:

***SPLUNK*** host="myhost" sourcetype="mytype" source="mydata:myname"
2013/05/03 09:54:47.144780 1234567890123456789 key1=1
2013/05/03 09:54:47.144783 1234567890123456789 key1=0
2013/05/03 09:54:47.345111 1234567890123456789 key1=0

What I am doing is simply move the file above into the sinkhole directory for batch indexing with metadata infomation specified after ***SPLUNK*** .

I am refering to the following doc, but still specified meatada infomation is not reflected when indexing.
http://docs.splunk.com/Documentation/Splunk/5.0.2/Data/Assignmetadatatoeventsdynamically

Is there any missing configuration or am I doing something wrong?
Any comment would be appreciated.

Thank you!

0 Karma
1 Solution

yannK
Splunk Employee
Splunk Employee

to force the header detection, add in props.conf

[source:://opt/sinkhole/.../*]
HEADER_MODE=always

see http://docs.splunk.com/Documentation/Splunk/5.0.2/admin/Propsconf

View solution in original post

yannK
Splunk Employee
Splunk Employee

to force the header detection, add in props.conf

[source:://opt/sinkhole/.../*]
HEADER_MODE=always

see http://docs.splunk.com/Documentation/Splunk/5.0.2/admin/Propsconf

melonman
Motivator

Thank you for your answer!

HEADER_MODE = | always | firstline | none
* Determines whether to use the inline ***SPLUNK*** directive to rewrite index-time fields.
* If "always", any line with ***SPLUNK*** can be used to rewrite index-time fields.
* If "firstline", only the first line can be used to rewrite index-time fields.
* If "none", the string ***SPLUNK*** is treated as normal data.
* If , scripted inputs take the value "always" and file inputs take the value "none".
* Defaults to .

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...