Now you can tag HEC events for any HEC end point ( including s2s) without paying for third party software. https://community.splunk.com/t5/Getting-Data-In/Splunk-HTTP-Event-Collector-support-for-custom-metadata-tags/m-p/703131/highlight/true#M116292
... View more