Hi All,
To forward data to third-party systems, integrated splunk agent with below configs.
Third party is able to receive data by listening on TCP port.
Issue: Unable to view default internal fields like source or host required for data enrichment.
Tried adding host and source in inputs.conf, but no luck.
Is there any limitation for forwarding internal fields to third party systems?
inputs.conf
[blacklist:$SPLUNK_HOME/var/log/splunk]
[monitor:///tmp/test1.log]
_TCP_ROUTING = App1Group
outputs.conf
[tcpout:App1Group]
server=<ip address>:<port>
sendCookedData = false
