Populate event with extra fields as global default...

Getting Data In

Hi,

I would like to populate all forwarded events (from various stanzas) with a centralised list of field:value pairs.

Can this be achieved in a centralised location, avoiding the need to write individual transforms for each sourcetype?

Thank you in advance.

Get Updates on the Splunk Community!

In today’s data-heavy environment, organizations are caught in a data distribution dilemma. As data volumes ...

Streamlining Data Management: Introducing a unified experience in Splunk Managing data at scale shouldn’t feel ...

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Populate event with extra fields as global default on forwarders.