https://community.splunk.com/t5/Getting-Data-In/Getting-metadata-such-as-host-source-and-source-type-when/m-p/468144#M100207 <P>Actually I need all the event changes from Splunk forwarders(Universal and Heavy both) into a third party system, so I am using a java socket connection to get all the event changes in raw form, for that, I have added <EM>sendCookedData = false</EM> in <EM>outputs.conf</EM> configuration file under $SPLUNK_HOME/etc/system/local/. But as a downside of this change, I am not getting any metadata such as host, source, and source type, etc. <BR /> But I need these metadata in my application. Is there any way to get these metadata when we are forwarding the event changes to a third party system in raw form?</P> Thu, 19 Dec 2019 06:38:53 GMT dk30390 2019-12-19T06:38:53Z https://community.splunk.com/t5/Getting-Data-In/Getting-metadata-such-as-host-source-and-source-type-when/m-p/468144#M100207 <P>Actually I need all the event changes from Splunk forwarders(Universal and Heavy both) into a third party system, so I am using a java socket connection to get all the event changes in raw form, for that, I have added <EM>sendCookedData = false</EM> in <EM>outputs.conf</EM> configuration file under $SPLUNK_HOME/etc/system/local/. But as a downside of this change, I am not getting any metadata such as host, source, and source type, etc. <BR /> But I need these metadata in my application. Is there any way to get these metadata when we are forwarding the event changes to a third party system in raw form?</P> Thu, 19 Dec 2019 06:38:53 GMT https://community.splunk.com/t5/Getting-Data-In/Getting-metadata-such-as-host-source-and-source-type-when/m-p/468144#M100207 dk30390 2019-12-19T06:38:53Z