When we are ingesting data through Splunk Web, it's coming perfectly fine, but when ingested through a forwarder, the data is coming only in _raw field. After applying multikv, the data format gets corrected. Can anyone suggest some solution?
... View more