1: If you want your forwarders to show up there, you need to run the following command: https://docs.splunk.com/Documentation/Splunk/9.0.0/Updating/Configuredeploymentclients splunk set deploy-poll <IP_address/hostname>:<management_port> splunk restart This will update a file called deploymentclient.conf on your universal forwarders. In a production environment, you would deploy that file in an app or have the app already packaged with the OS image, but the above command will still work. 2:  If you have 2 forwarders, each receiving data feeds from other hosts/devices, you will need to use Splunk metadata field "host".  This can be done by either manually setting a value per input, or having a value extracted from a filename or filepath.  It is possible to set the host name based on the content of the event, but you will need to do this on your indexer or heavy forwarder, and universal forwarder will not work. https://docs.splunk.com/Documentation/Splunk/9.0.0/Data/Overridedefaulthostassignments   ... View more

This has been solved for a few versions now. https://docs.splunk.com/Documentation/ES/7.0.1/Admin/Adaptiveresponserelay   ... View more

That index may need to be set to default searchable to be picked up by the populating search. Or edit the search to specify the index. ... View more

I added some fields at the end of the table to show the day, hour and year. You can make more  using the time variables here:  https://docs.splunk.com/Documentation/Splunk/9.0.0/SearchReference/Commontimeformatvariables   | inputlookup append=T incident_review_lookup | rename user as reviewer | lookup update=true user_realnames_lookup user as "owner" OUTPUTNEW realname as "owner_realname" | eval "owner_realname"=if(isnull('owner_realname'),'owner','owner_realname') | lookup update=true user_realnames_lookup user as "reviewer" OUTPUTNEW realname as "reviewer_realname" | eval "reviewer_realname"=if(isnull('reviewer_realname'),'reviewer','reviewer_realname') | eval nullstatus=if(isnull(status),"true","false") | eval temp_status=if(isnull(status),-1,status) | lookup update=true reviewstatuses_lookup _key as temp_status OUTPUT status,label as status_label,description as status_description,default as status_default,end as status_end | eval status=if(isnull(status_label),0,status),status_label=if(isnull(status_label),"Unassigned",status_label),status_description=if(isnull(status_description),"unknown",status_description),"status_default"=case(match('status_default', "1|[Tt]|[Tt][Rr][Uu][Ee]"),"true",match('status_default', "0|[Ff]|[Ff][Aa][Ll][Ss][Ee]"),"false",1=1,'status_default'),"status_end"=case(match('status_end', "1|[Tt]|[Tt][Rr][Uu][Ee]"),"true",match('status_end', "0|[Ff]|[Ff][Aa][Ll][Ss][Ee]"),"false",1=1,'status_end'),status_group=case(status_default=="true","New",status_end=="true","Closed",status=0,"New",1=1,"Open") | fields - temp_status | eval status=if((isnull(status) OR isnull(status_label)) AND nullstatus=="false",0,status) | eval status_label=if(isnull(status_label) AND nullstatus=="false","Unassigned",status_label) | eval status_description=if(isnull(status_description) AND nullstatus=="false","unknown",status_description) | eval _time=time | fields - nullstatus | eval eventHour=strftime(_time,"%H") | eval eventMin=strftime(_time,"%M") | eval eventDay=strftime(_time,"%A") | eval eventYear=strftime(_time,"%Y") | table _time owner rule_id rule_name status_label eventHour eventDay eventMin eventYear   ... View more