I am a network admin. I followed the documentation on how to connect an F5 load-balancer, Cisco ASA, and Checkpoint Firewall. The only way I could validate logs were making it to the Splunk server was with a packet capture. All searches initially failed. In "Data Summary, my ASA is not listed. The only way I can see any logs is with index=%ASA sourcetype="cisco:asa". I found my F5 listed by IP and clicking on that host DOES show logs. I found my Checkpoint listed by IP. Clicking on that host fails to bring up anything. It is also listed by hostname but nothing comes up with that either. Windows servers do show up by host name and they show results. There are also host names titled 2016, EDT, CST, INFO, UTC, Version, WARN. What are those? They aren't hosts as I know it. This is a mess. How does Splunk define a "host"? We are using Splunk 6.5 - Single Node. ... View more