We were able to find the root cause. Apparently the forwarder was configured to be a HF which was expecting the TA to be deployed in the HF as well. So initially, it was communicated that we are working on a UF -> IDX turned out to be a HF -> IDX which makes the deployed TA in the IDX not able to map the sourcetype since it should have been deployed in HF. Thanks for the great help @esix 🙂 ... View more

hi esix. It's thru transforms at ingestion..regarding the setup, we have something like UF(on-prem) --> IDX (cloud).. With this scenario, would it make any difference? ... View more

does this work for multiple tokens? ... View more