Hi, I have multiple clients sending their Windows events to a Windows Event Collector (WEC). Each WEC has a Splunk Universal Forwarder installed, which forwards the events into Splunk. Right now, events show up in Splunk with where the host reflects the original client that generated the event. That’s good, but I also need to know which WEC forwarded the event. What’s the best way to add the WEC hostname to each event in a scalable way (since I have multiple WECs in the environment)? ... View more