Note that you don't have to append to the existing. In fact, it will be easier to just define a new transform from scratch, with TRANSFORMS-something = wmi-sec-evt-index, with -something set to anything other than -FIELDS.
Note that you don't have to append to the existing. In fact, it will be easier to just define a new transform from scratch, with TRANSFORMS-something = wmi-sec-evt-index, with -something set to anything other than -FIELDS.