topic Populate event with extra fields as global default on forwarders. in Getting Data In https://community.splunk.com/t5/Getting-Data-In/Populate-event-with-extra-fields-as-global-default-on-forwarders/m-p/312135#M58536 <P>Hi,</P> <P>I would like to populate all forwarded events (from various stanzas) with a centralised list of field:value pairs. </P> <P>Can this be achieved in a centralised location, avoiding the need to write individual transforms for each sourcetype?</P> <P>Thank you in advance.</P> Fri, 19 Jan 2018 09:26:36 GMT andrei1bc 2018-01-19T09:26:36Z Populate event with extra fields as global default on forwarders. https://community.splunk.com/t5/Getting-Data-In/Populate-event-with-extra-fields-as-global-default-on-forwarders/m-p/312135#M58536 <P>Hi,</P> <P>I would like to populate all forwarded events (from various stanzas) with a centralised list of field:value pairs. </P> <P>Can this be achieved in a centralised location, avoiding the need to write individual transforms for each sourcetype?</P> <P>Thank you in advance.</P> Fri, 19 Jan 2018 09:26:36 GMT https://community.splunk.com/t5/Getting-Data-In/Populate-event-with-extra-fields-as-global-default-on-forwarders/m-p/312135#M58536 andrei1bc 2018-01-19T09:26:36Z