I don't have good news for you, but I do have some questions. Sadly, I suspect what you are trying to do is outside the scope of transforms, especially when using a deployment server. 1. Is this a heavyweight forwarder, or a universal forwarder? 1a. If a Heavyweight, then how is the data being sent to it? From another forwarder? 1a1. If from a UF, then I suspect you'll have to write different apps, one for each HF. This is far from ideal, but will get the job done. Hopefully you don't have too many HFs to have to create for these rules. 1a2. If from a syslog or networking device you can just use the default hostname and the HF's hostname will be applied. 1b. If this is a universal forwarder, then is the data coming from another UF, or something like a syslog device? 1b1. If from another UF you have issues coming. I don't think you can make this work. 1b2. If from a syslog or network device, then use the default hostname, which will default to the forwarder. Maybe someone else will have a better answer for you.
... View more