Good day everyone.
I am looking for a way to add server-specific information to events that are forwarded to my Splunk Indexers via Universal Forwarders.
The additional information would be related to something customer or service specific information that would make searching for logs easier than needing to know server hostnames (which are generic and would not be specific to a customer or function). For instance, logs ingested from Server A would be associated with Customer X and component Y, but the same log files ingested from Server B would be associated with Customer Z and component A. This would help my engineers to find issues with Customer X or component Z without needing to know specific server hostnames - which could change day to day or week to week.
I have been scouring through the documentation but have not found anything that has jumped out at me as the solution, or something possible.
Is this capability something that exists? And if so, how could it be implemented?
Thank you.
