Hi all,
I'm looking to add some custom fields to the Splunk Forwarder, but am struggling to find the a way of achieving this and determine the best way for performance.
Could I please get an example of configuring this through the forwarder for two additional fields to be appended to the source only to be retrieved through search with these values. Additionally, these two fields should be able to be populated through a script as this value will reside within a file on the server the forwarder resides.
Thanks in advance for any input.
... View more