How to add prefix string to events before forwardi...

Getting Data In

Hi everybody,

I would like to duplicate data coming from my sourcetype in such a way:

- send the original data to Splunk for indexing.

- send the duplicated events to an external server with "<DNS>" prefix string.

How should I modify the transform.conf file in order to do that?

Another question: is there a better way to forwards logs to external server while keeping the original source host (source IP) instead of adding prefixes like what I'm trying to do.

Thanks in advance,

Angelo

Get Updates on the Splunk Community!

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Think Like an Architect: Introducing the Splunk Certified Cybersecurity Defense ...

In cybersecurity, defenders respond to threats. Architects design the systems that stop them. As ...

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...