excellent - that did the trick. Adding the authToken key to the Spec file in the readme folder and adding to the streamfwd.conf with the same key as in the HTTPCollector and the Forwarder Auth and everything seems to be talking. Just need to play around to find out exactly what is needed where exactly. Thanks for the help Colin ... View more

Another solution my be something like base search | sort server, -value | streamstats count as rank by server | where rank < 3 | table server counter value rank I don't have sufficient data to run a meaningful comparison of the different methods, so don't know which is more performs better over a large dataset. ... View more