Configuring Splunk Metadata - ironstream_for_splunk - ironstream_for_elastic - ironstream_for_kafka - Ironstream_Hub - 1.3

Ironstream Hub Administration

Product type
Software
Portfolio
Integrate
Product family
Ironstream
Product
Ironstream > Ironstream for Splunk®
Ironstream > Ironstream for Kafka®
Ironstream > Ironstream Hub
Ironstream > Ironstream for Elastic®
Version
1.3
Language
English
ContentType
Administration
Product name
Ironstream Hub
Title
Ironstream Hub Administration
First publish date
2022

The Splunk Metadata process is used to add metadata when sending data to Splunk using a TCP/IP client. This metadata controls Splunk’s indexing process.

If ProcessType is set to SplunkMetaData, a parent field named SplunkMetaDataConfiguration must be populated with these Mandatory fields:

Fields Description Valid Values
SourceType The value with which to set the source type default field in Splunk.
Source The value with which to set the source default field in Splunk.
Index The index that will receive the data.

Example Splunk Metadata Process File

An example of a Process configuration file that adds Splunk meta data and sends the results to a Target. The records will be sent to the “smf030” index with the Splunk default fields source type and source being added to each record with the values “SyncsortMF” and “mainframe” respectively.
{
  "Name": "SMF030SplunkMetadata",
  "Id": "4b205b49-970b-4e84-ad13-28c0ffdf7be3",
  "SplunkMetaDataConfiguration": {
    "SourceType": "SyncsortMF",
    "Source": "mainframe",
    "Index": "smf030",
  },
  "ProcessType": "SplunkMetaData"
}