I figured out the answer. If you send a packet with a given source address, Splunk must be able to actually reach that address. If it is unable to reach the address, even if a packet is received, Splunk will not consider it a valid event. I discovered this by trying to ping 10.10.12.9 from S and found it was unreachable. I added a route on S then checked by pinging that the 10.10.12 address was now reachable. After doing so, I re-sent the Scapy-created packet, and it showed up in the sandbox index as a valid event. ... View more