Is there a way to make Light Forwarder include the name of the file it is sending events from (i.e. source) when sending raw data to a 3rd party system?
The data stream is raw to 3rd party. No source, sourcetype or Host.
i believe LWF does that by default, for example, when you see in the indexer you can tell what the source is, this was brought by the LWF.
Hence i am assuming you need to train the third party system to recognize this field from the raw data..
Unfortunatly outputs.conf has 'sendCookedData = false'. And we are senting to a 3rd party system. So the data stream only has the raw event.
