Would like to add a field representing the worker process for stream (cribl_wp), but don’t want to enable it globally in the splunk destination. Only interested in having this field added for one specific sourcetype for data processed in one specific pipeline. Guessing this must exist as an environment variable in C.env. Hoping to just add an eval function into the pipeline.
Is there a way to add field for worker process in a specific pipeline and not globally for the destination?
You’re correct. You can access this value in an Eval function using
Note though that this will only be available in a capture if you are capturing before Destination.
C.os.hostname() will evaluate to the hostname of the stream workerr
C.os.hostname() is more equivalent to cribl_host. I was looking for the specific worker process which CRIBL_WORKER_ID provides.