Make sure your logs are written as type.log or something.type.log because the Splunk platform uses the second part of the name to more specifically source type the log. For example, conn.log produces the bro_conn sourcetype. ... View more