We have couple development environments that have Windows servers with same names (i.e. HOSTNAME1) and would like to add meta "env" to every log file sent from local forwarder to splunk server. I can achieve this by adding "_meta = env::env01" to every log type in inputs.conf i.e.: [WinEventLog://Application] _meta = env::env01 [WinEventLog://Security] _meta = env::env01 BUT I when I try to add it to [default] at the top of inputs.conf , to save repeating _meta=env01 for every log type, nothing happens, i.e.: [default] host = HOSTNAME _meta = env::env01 host= gets applied, but _meta doesn't. What am I doing wrong? How could I achieve apply meta to every entry going out of server, if [default] is not supported? ... View more