How can I tag the WEC hostname in events while keeping the original client host?

[echojosh]

Hi,

I have multiple clients sending their Windows events to a Windows Event Collector (WEC). Each WEC has a Splunk Universal Forwarder installed, which forwards the events into Splunk.

Right now, events show up in Splunk with where the host reflects the original client that generated the event. That’s good, but I also need to know which WEC forwarded the event.

What’s the best way to add the WEC hostname to each event in a scalable way (since I have multiple WECs in the environment)?

[PrewinThomas]

@echojosh 

Do you have a field called ComputerName in your events which should reflects the original machine that generated the event for events collecting from a WEC.

Regards,
Prewin
If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!