Getting Data In

Populate event with extra fields as global default on forwarders.



I would like to populate all forwarded events (from various stanzas) with a centralised list of field:value pairs.

Can this be achieved in a centralised location, avoiding the need to write individual transforms for each sourcetype?

Thank you in advance.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!