topic Re: LWF send source name when raw in Getting Data In

LWF send source name when raw

rroberts — Mon, 15 Nov 2010 23:55:13 GMT

Is there a way to make Light Forwarder include the name of the file it is sending events from (i.e. source) when sending raw data to a 3rd party system?

Re: LWF send source name when raw

Genti — Tue, 16 Nov 2010 08:32:12 GMT

i believe LWF does that by default, for example, when you see in the indexer you can tell what the source is, this was brought by the LWF.

Hence i am assuming you need to train the third party system to recognize this field from the raw data..

Re: LWF send source name when raw

rroberts — Wed, 17 Nov 2010 00:50:27 GMT

Unfortunatly outputs.conf has 'sendCookedData = false'. And we are senting to a 3rd party system. So the data stream only has the raw event.

Re: LWF send source name when raw

rroberts — Thu, 18 Nov 2010 00:44:57 GMT

The data stream is raw to 3rd party. No source, sourcetype or Host.