I confirm this is how I solved. Many thanks! ... View more

I solved fixing the tags inside the estreamer dashboard. ... View more

It seems that there are no tags so the data cannot be used in any datamodel. Is this a normal behavior? In estreamer TA there are no Tags, in estreamer dashboard there are eventtypes but again no tags. I put a picture here: https://imgur.com/MwrXzqf ... View more

I saw that there's no CIM in the app description, so I thought it was not compliant. After investigating a bit I could see a few tag and eventypes, but i don't see anything matched. In the logs I receive there's a lot of fields that are not matched (here the list of the possible fields I have). source sourcetype app app_proto dest dest_ip fw_rule http_response rule src src_ip url user time index linecount splunk_server I'm pretty sure that I should have a ton of other fields. Can you confirm that I should see more things? Many thanks ... View more