1. Indexes can be viewed as a named repository for data. There are multiple reasons you would want to store certain data in one index and other data in another. These include Access controls - assign permissions to certain indexes to certain users Performance - data that your routinely search against and want fast results from can be stored separately from noisy data that you do not regularly search. Also you can specify how much (or how old) data is stored in faster storage before it transitions to slower storage.  Retention - data in one index can "expire" before other data that needs stored long term index=* simply means search all indexes that the user has access to (if your account is limited, you will only see the indexes which you have been given permission to see) sourcetypes are used in Splunk to identify the type of data and how fields within that data should be extracted - there's more to it than that, but that's the gist of it.  When there is no 'OR' an 'AND' is implied.  2. The short answer is yes, the message is included. Splunk generally splits Windows events into two parts where the Message field begins. Splunk does this based on sourcetype and it allows Splunk to properly extract field value pairs (e.g. AccountName=john.smith).  3. There are several fields in the data that should identify the host. The first and fastest method is simply the host field. This is valid when the environment uses the Universal Forwarder to retrieve data from the hosts. It is possible to manually load evtx files into Splunk and specify another system as the host.  If the host field doesn't match up with what you expect, you can probably refer to the Computer field.     Hope that helps.  ... View more