Splunk Metadata

The Splunk Metadata process is used to add metadata when sending data to Splunk using a TCP/IP client. This metadata controls Splunk’s indexing process.

If ProcessType is set to SplunkMetaData, a parent field named SplunkMetaDataConfiguration must be populated with these Mandatory fields:

Fields Description Valid Values
SourceType The value with which to set the source type default field in Splunk.
Source The value with which to set the source default field in Splunk.
Index The index that will receive the data.

Example Splunk Metadata Process File

An example of a Process configuration file that adds Splunk meta data and sends the results to a Target. The records will be sent to the “smf030” index with the Splunk default fields source type and source being added to each record with the values “SyncsortMF” and “mainframe” respectively. 
{
  "Name": "SMF030SplunkMetadata",
  "Id": "4b205b49-970b-4e84-ad13-28c0ffdf7be3",
  "SplunkMetaDataConfiguration": {
    "SourceType": "SyncsortMF",
    "Source": "mainframe",
    "index": "smf030",
  },
  "ProcessType": "SplunkMetaData"
}