For Splunk team, I think a better/easier way for us to add indexed "tags" (i.e. additional fields) to all events of a certain sourcetype/source, or even globally, (all events sent from this host), from a Universal Forwarder is something which needs first class support and documentation. Seems like most folks are having to hack on _meta (and then on fields.conf and possibly elsewhere). My use case for example. We run hosts in AWS EC2 and we have several tags on our instances which identify things like server-type (api, worker, etc), environment (prod, staging, dev, etc), and additionally things like instance_id, aws region, etc. Would be awesome if we can either provide this tags from a file. ( What I'm currently doing is running a cloud-init script at start to assemble all of the tags and inject them into the _meta field on my inputs.conf of forwarder. Also, I had to deploy a systemd override/drop-in config for splunkd to ensure splunk forwarder is started only after my cloud-final, as I'm using cloud-init per-instance start scripts for this instance-start-time configuration hack, but YMMV for other folks.) ... View more

By no means an expert, but reading the docs, seems like you need to: in PREAMBLE_REGEX , specify the regex to match the whole line to throwaway.. perhaps ^#.* in FIELD_HEADER_REGEX , need to regex capture the actual part of the line which has the field headers to extract, perhaps ^#fields\t(.*) http://docs.splunk.com/Documentation/Splunk/6.0.3/Data/Extractfieldsfromfileheadersatindextime ... View more

Here's to hoping this is fixed in 6? ... View more

I think you may need to use priority to override default unarchiving processors. See my answer if it may be helpful... ... View more

I struggled with this way too long also. I have a custom access log format that is gzipped. It needs to be gunziped then piped through a custom converter to get to NCSA format (access_combined). No matter what I seemed to do, my log format would seem to get unarchived, but never passed through my converter (even though it seemed to be honoring my source:: spec i had to do this in local/props.conf: [source::/path/to/my/special/logs/.../*] unarchive_cmd = gunzip | my_custom_converter unarchive_sourcetype = access_combined NO_BINARY_CHECK = true priority = 10 The key here seems to be that I had to use priority keyword. I believe this was necessary to override the default gzip unarchiver which seemed to take precedence over whatever custom sourcetype I defined. I'm sure there is a way to see how this is getting parsed and processed, but it's not really obvious. Full disclosure: I am a complete splunk newbie. @lowell: I believe they did have .gz extensions. ... View more