host=$decideOnStartup 在 Windows EC2 上的 splunk 配置中不工作

host=$decideOnStartup not working in splunk configuration on Windows EC2

作为someone mentioned in the Splunk forum:

$decideonstartup just would not work for me.

splunk daemon is supposed自动设置值:

Note: By default, the host attribute is set to the variable $decideOnStartup, which means that it's set to the hostname of the machine splunkd is running on. The splunk daemon re-interprets the value each time it starts up.

但它对我来说只是 host=$decideonstartup

通过 AWS SSM 文档配置 Splunk 时设置此值的最佳方法是什么?

使用EC2 instance metadata service:

$token = Invoke-RestMethod -Headers @{"X-aws-ec2-metadata-token-ttl-seconds" = "21600"} -Method PUT –Uri http://169.254.169.254/latest/api/token
$ip = Invoke-RestMethod -Headers @{"X-aws-ec2-metadata-token" = $token} -Method GET -Uri http://169.254.169.254/latest/meta-data/local-ipv4

然后您可以将 EC2 实例 IP 插入 inputs.conf 文件 host=$ip,假设您正在 SSM 文档中构建 inputs.conf 文件。