NetXMS Support Forum

I have a windows event collector server and I want to get the forwarded events from that server. The difference is that there is a column named computer which holds the originator pc of that event. However in event viewer I cannot see that info as source. I see the windows event collector server as source (as expected).

Is there a way to set that computer field (I can get the value using %<number>) as source. Or I have to create duplicate events for forwarded events and put computer info in event string.

I don't think you can change an event source after that event is received.
As you indicated, you can create a new event and set the correct source for that new event though.
To avoid your database doubling in size, you could run a regular cronjob/scheduled task to clean out the duplicates.

Or you could use a cronjob/scheduled task to adjust the source directly inside the database at regular intervals. That wouldn't be live though.
Or setup a trigger in the database to automatically perform that task in certain cases. Not sure about the performance impact on such a step though.

Edit: Or simply use the inbuilt and smart way of doing it, which Victor mentioned below. 

Another option to avoid storing double events is to remove "write to event log" option from original event.

Best regards,
Victor