Within our splunk environment we have 1 search head, 3 search peers, 1 deployer/master/license and 500+ UF. The uf's are configerd with WMI monitoring.
Since the field DisplayName from the WMI output isn't correct extracted, I would like to perform a custom extraction at index time. I know that the search time extractions are the best practice, but since it is a lot of data i would like to do this at index time.
So this is what I did;
Deployed prop.conf and tranforms.conf on the search peers.