Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Config to remove the default "source" field #71

Open
s-m-p opened this issue May 25, 2022 · 0 comments
Open

Config to remove the default "source" field #71

s-m-p opened this issue May 25, 2022 · 0 comments

Comments

@s-m-p
Copy link

s-m-p commented May 25, 2022

Hello and please forgive me if this is not the appropriate place to ask this question. I would like to know if it's possible to add configuration to the daemon.json file to completely remove the value of the 'source' field from the event because I would like to let Splunk automatically set the source at index time. Reading the documentation, I see there is an optional flag 'splunk-source' where I can change the value. But I don't want to change the value, I would like to completely remove it from the POST body. Is there way to do this in the configuration file? It seems all the doc examples show a value for that field.

Here's what our current Splunk config looks like. I'm not the app developer here, so this information was provided to me when I requested the configuration. All the variables are defined and the event is being indexed as I would expect. I just want to remove the source field from the POST body.
"logConfiguration": {
"logDriver": "splunk",
"options": {
"splunk-url": "${splunk_url}",
"splunk-index": "${splunk_index}",
"splunk-insecureskipverify": "true",
"splunk-sourcetype": "${splunk_sourcetype}",
"splunk-format": "json"
},

Thanks in advance.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant