https://community.splunk.com/t5/Getting-Data-In/How-to-add-prefix-string-to-events-before-forwarding-to-external/m-p/631885#M108289 <P>Hi everybody,</P> <P>I would like to duplicate data coming from my sourcetype&nbsp;in such a way:</P> <P>- send the original data to Splunk for indexing.</P> <P>- send the duplicated events to an external server with "&lt;DNS&gt;" prefix string.</P> <P>How should I modify the transform.conf file in order to do that?</P> <P>Another question: is there a better way to forwards logs to external server while keeping the original source&nbsp; host (source IP) instead of adding prefixes like what I'm trying to do.&nbsp;</P> <P>Thanks in advance,</P> <P>Angelo</P> Wed, 22 Feb 2023 17:26:07 GMT Zanusha443 2023-02-22T17:26:07Z https://community.splunk.com/t5/Getting-Data-In/How-to-add-prefix-string-to-events-before-forwarding-to-external/m-p/631885#M108289 <P>Hi everybody,</P> <P>I would like to duplicate data coming from my sourcetype&nbsp;in such a way:</P> <P>- send the original data to Splunk for indexing.</P> <P>- send the duplicated events to an external server with "&lt;DNS&gt;" prefix string.</P> <P>How should I modify the transform.conf file in order to do that?</P> <P>Another question: is there a better way to forwards logs to external server while keeping the original source&nbsp; host (source IP) instead of adding prefixes like what I'm trying to do.&nbsp;</P> <P>Thanks in advance,</P> <P>Angelo</P> Wed, 22 Feb 2023 17:26:07 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-add-prefix-string-to-events-before-forwarding-to-external/m-p/631885#M108289 Zanusha443 2023-02-22T17:26:07Z