Getting Data In

Is there a way I can change source name on HEC?

AbhinavRanjan
Loves-to-Learn Lots

I am using HEC to push the data to Splunk, and in the HEC we have a field Source, And the log which I am forwarding to Splunk too have a field name Source. 

The issue I am facing is, that both the source name gets merged and on each log, I can see the same, two values for the source.

I don't want to change the field of my log, Is there a way I can change something on HEC?

Labels (1)
Tags (3)
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...