Wow. I have to give serious thanks to Chris G and Gkanapathy for working with me on this. I just had a major realization - (and facepalm event) - where I realized I was doing something stupid 😃 I don't need the ossec app installed on my systems with the universal forwarder, I only need it on my search heads. What I need on my universal forwarders is an update to the Splunk_TA_NIX/local/inputs.conf file to add: ############################################################ # Sample inputs for OSSEC data sources (Local Server) ############################################################ [monitor:///var/ossec/logs/alerts/alerts*] disabled = 0 sourcetype = ossec_alerts [monitor:///var/ossec/logs/ossec.log] disabled = 0 sourcetype = ossec_log [monitor:///var/ossec/logs/active-responses.log] disabled = 0 sourcetype = ossec_ar an then it will catch the changes to the system. Thanks to both of you for helping me! --John ... View more