Hi, I want to see my data in the ES dashboard Security Domains -> Endpoint -> Endpoint Changes. I created the following things: props.conf with CIM compliant field aliases. eventtypes.conf [MyEventType] search = index=MyIndex sourcetype=MySourcetype   tags.conf [eventtype=MyEventType] change=enabled endpoint=enabled I can successfully search the events with tag=change and tag=endpoint. I can also successfully search the data with the data model constraint (`cim_Change_indexes`) tag=change NOT (object_category=file OR object_category=directory OR object_category=registry) tag=endpoint. However, the dashboard stays empty. When I manually execute one of the dashboard searches | `tstats` append=T count from datamodel=Change.All_Changes where nodename="All_Changes.Endpoint_Changes" I get not results. When I change nodename="All_Changes.Endpoint_Changes"  to nodename="All_Changes" I see my events. So the question is, what do I need to do to get my events in the node All_Changes.Endpoint_Changes?   ... View more

Hi all, I am sending a multiline event to Splunk Enterprise. The first row contains metadata, the second row the field names, the third row the actual values. It looks like this: ***SPLUNK*** host=hostname index=testindex source=testsource sourcetype=testsourcetype Timestamp,"Arbitrary field name" 1550850412192,89 The field name is arbitrary, which means it is variable. At the first event, it could be "Field name 1" and at the second "Field name 2". Currently, Splunk shows me two events. 1. Timestamp,"Arbitrary field name" 2. 1550850412192,89 What I want is that it creates a field from the "Arbitrary field name" and assigns value 89. My props.conf looks like this at the moment: INDEXED_EXTRACTIONS = csv FIELD_DELIMITER = , HEADER_FIELD_LINE_NUMBER = 2 ... View more