Hi,
I'm using the stream forwarder in order to index .pcap files into splunk.
Is there any way to add the source path of pcap (filename) to the indexed events?
In general, is there any way to intervene in the parsing process?
Thanks,
EG
At this time there is no way to get the pcap filename into Splunk, and the only way to intervene in the parsing process is by way of stream configurations (filters, field selection, etc).