Is there a way to ID the info being sent to one indexer from multiple forwarders in separate environment?

[tpward123]

(Novice) Is there a way to identify uniquely the information that is being sent to a single indexer from multiple forwarders in separate environments?  Each environment is a mirror of the other.  They all have the same IPs and hostnames; including the forwarders.
Maybe there is a tag the forwarder can apply or something that makes them unique?

[PickleRick]

No. There is no "channel-level" metadata that you could leverage. So if all your forwarders are undistinguishable from one another there's no telling where the event came from.

[tpward123]

Thanks Rick.
I've been searching the Solutions archive
Is there a _meta value that I can set to reflect that environment is sending?

Env1::Site1
Env1::Site2
....

Env2:Site1
Env2:Site2

[PickleRick]

You can do that (and that's exactly what I use in one of my environments).

If you can adjust your forwarder configuration, that's probably the way to go if you want to have a 100% sure method of differentiating betwen various sites.

There is no default field you can set (unless you use the host field but be aware that some sourcetypes can overwrite this field during indexing) so you have to set your own indexed field. And remember to configure it properly on the search-heads as well.

EDIT: and try to think of a field name that's highly unlikely to appear in your events so that your fields do not clash.