I didn't see any info about parsing these logs. Mine are sending as syslog but nothing is parsed and it's all XML formatted. Did you chose something other than syslog or create a parser?   ... View more

It's mostly in the docs: https://docs.splunk.com/Documentation/Forwarder/8.2.5/Forwarder/Installtheuniversalforwardersoftware and maybe https://docs.splunk.com/Documentation/Forwarder/8.2.5/Forwarder/Configuretheuniversalforwarder As to logrotate - that's all outside of Splunk.  Basic Linux maintenance on log files.  Any internet search engine is your friend here and all will lead to results that are useful. Best search may be though to get some "Splunk specific" search results, using a search like "splunk syslog" and read through a few of those best practices that will come up. ... View more

I'd posted an idea on Splunk Ideas.  Please vote to get this add-on and app created.   VMware Unified Access Gateway & Horizon Desktop Desktop | Ideas (splunk.com) ... View more

The ExtraHop Splunk App may not be what you are most interested in. If what you want is to build dashboards or reports on ExtraHop wire data, you need to configure Splunk as your Syslog SIEM entry in ExtraHop. You can then build triggers to send custom fields and values to Splunk. Check out this article on ExtraHop Forum ExtraHop To Splunk Article ... View more