https://community.splunk.com/t5/Getting-Data-In/Why-is-stream-http-not-showing/m-p/567178#M100766 <P>I am having the same issue, were you able to find the solution to this.&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/43229">@mchlbooth</a>&nbsp;</P> Thu, 16 Sep 2021 01:13:26 GMT pizzadudehd 2021-09-16T01:13:26Z https://community.splunk.com/t5/Getting-Data-In/Why-is-stream-http-not-showing/m-p/467324#M80539 <P>I'm very new too splunk and using the botsv1-attack-only file to begin learning, please be gentle. </P> <P>When I do an initial search with index="botsv1" imreallynotbatman.com the sourcetype is only showing two values of data-2 and botsv1_data_set/var/lib/splunk/botsv1/db/db_1470868141_1470799731_28/rawdata/journal. I'm not seeing results for the splunk add-ons such as stream and suricata. When sourcetype="stream:http" is added to the search no events are returned. I have no idea why this is happening. The search is set to All time and verbose mode.</P> <P>Many thanks in advance.</P> Wed, 30 Sep 2020 04:07:02 GMT https://community.splunk.com/t5/Getting-Data-In/Why-is-stream-http-not-showing/m-p/467324#M80539 mchlbooth 2020-09-30T04:07:02Z https://community.splunk.com/t5/Getting-Data-In/Why-is-stream-http-not-showing/m-p/567178#M100766 <P>I am having the same issue, were you able to find the solution to this.&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/43229">@mchlbooth</a>&nbsp;</P> Thu, 16 Sep 2021 01:13:26 GMT https://community.splunk.com/t5/Getting-Data-In/Why-is-stream-http-not-showing/m-p/567178#M100766 pizzadudehd 2021-09-16T01:13:26Z