Hi @redbugz If you are sending data in Splunk via a different source (channel identifier) then you can search events for that particular source by below query : source="http:(source_name OR channel identifier)" Example: As here let's take one example if you have created one HEC token and its name is "network_demo" and that is for your network instance logs then you can search particular network logs by searching source="http:network_demo". For more information about HEC, Please follow below doc: http://dev.splunk.com/view/event-collector/SP-CAAAE7F Thanks, Dixit ... View more