Hi,
Is there a way to use the IP address of the indexer on the universal forwarder but have the name of the host displayed on the indexer ??
Here is my configuration :
[tcpout]
defaultGroup = indexer-group
[tcpout:indexer-group]
maxQueueSize = auto
server = 172.44.23.114:9997
[tcpout-server://172.44.23.114:9997]
Meaning that on my index it would show "prod-log-server" (the hostname) instead of 172.44.23.114
The indexer address used in outputs.conf
is unrelated to any hosts set in inputs.conf
(or overridden in transforms.conf
... so yes, there is a way - nothing's in your way in fact.