Uncooked Data Containing hostname

[lukessi]

I am sending uncoooked data but the hostname the other end are seeing is the Heavy Forwarder.

Is there anyway of sending the correct hostname?

[harsmarvania57]

How are you receiving data on Heavy Forwarder ? From UF ? If yes then have you set sendCookedData=false in outputs.conf on both UF and HF?

[mstjohn_splunk]

hi @lukessi,

Thanks for posting. As @harsmarvania57 mentioned above, could you give us some more context for your query? You have a much better chance of getting your question answered if you provide more information about your issue. Plus, it will help guide future community users who are facing a similar problem.