We have a dashboard created using the add-on above in subject that worked fine until we upgraded SEP to SEP v14. I noticed that the index (Symantec) used is not being logged to. Updated SEP of the version 14 server to log to syslog and now see those entries coming in from the SEPM v.14 host as syslog. Not sure what needs to change (clear that host is logging to splunk but data is not being transformed and not being logged to symantec index. Looking to see if this should work on SEP14 and if so, how to modify so that queries used for panels in dashboard work. Thanks! ... View more