- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
custom fields overriding

gcusello

SplunkTrust
12-30-2022
07:00 AM
Hi at all,
a question before starting a new configuration.
I configured custom fields on some Universal Forwarders using _meta in inputs.conf and it correctly runs.
In my architecture there's an intermediate Forwarder that collects different _meta from Universal Forwarders and it correctly runs.
If now I try to add _meta to some inputs on the Heavy Forwarder itself: in your opinion (and/or experience), must I configure _meta in each input stanza of the Heavy Forwarder or can I configure the [default] stanza without overriding values from the other Universal Forwarders?
Thank you for your attention.
Ciao.
Giuseppe
