https://community.splunk.com/t5/Getting-Data-In/Internal-field-for-originating-forwarder/m-p/123506#M25485 <P>I finally found a way to achieve this in another thread: <A href="http://answers.splunk.com/answers/1453/how-do-i-add-metadata-to-events-coming-from-a-splunk-forwarder.html">http://answers.splunk.com/answers/1453/how-do-i-add-metadata-to-events-coming-from-a-splunk-forwarder.html</A></P> <P>You need to manually add the metadata field, but it should suffice.</P> Tue, 04 Nov 2014 11:49:16 GMT mikaelbje 2014-11-04T11:49:16Z https://community.splunk.com/t5/Getting-Data-In/Internal-field-for-originating-forwarder/m-p/123504#M25483 <P>Is there a way to see the originating forwarder for a specfic event? I haven't found any internal/metadata fields. There are scenarios where it would be interesting to pinpoint the exact intermediate forwarder. Something like "splunk_server" but for forwarders.</P> Tue, 08 Apr 2014 08:33:46 GMT https://community.splunk.com/t5/Getting-Data-In/Internal-field-for-originating-forwarder/m-p/123504#M25483 mikaelbje 2014-04-08T08:33:46Z https://community.splunk.com/t5/Getting-Data-In/Internal-field-for-originating-forwarder/m-p/123505#M25484 <P>No official comment here? This is very useful especially if one has a chain of forwarders and want to see where the event came in, which forwarder passed it on etc.</P> Tue, 04 Nov 2014 06:02:25 GMT https://community.splunk.com/t5/Getting-Data-In/Internal-field-for-originating-forwarder/m-p/123505#M25484 mikaelbje 2014-11-04T06:02:25Z https://community.splunk.com/t5/Getting-Data-In/Internal-field-for-originating-forwarder/m-p/123506#M25485 <P>I finally found a way to achieve this in another thread: <A href="http://answers.splunk.com/answers/1453/how-do-i-add-metadata-to-events-coming-from-a-splunk-forwarder.html">http://answers.splunk.com/answers/1453/how-do-i-add-metadata-to-events-coming-from-a-splunk-forwarder.html</A></P> <P>You need to manually add the metadata field, but it should suffice.</P> Tue, 04 Nov 2014 11:49:16 GMT https://community.splunk.com/t5/Getting-Data-In/Internal-field-for-originating-forwarder/m-p/123506#M25485 mikaelbje 2014-11-04T11:49:16Z