Getting Data In

Populate event with extra fields as global default on forwarders.

andrei1bc
Communicator

Hi,

I would like to populate all forwarded events (from various stanzas) with a centralised list of field:value pairs.

Can this be achieved in a centralised location, avoiding the need to write individual transforms for each sourcetype?

Thank you in advance.

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...