Without you posting your config -- I can't be certain but I ran into this issue last week. Which sourcetype are you using? File or Syslog? In our case the issue was that even though the logs were coming in via syslog it actually still required the file sourcetype in order to correctly parse. One of the showing signs for me was that the user field was replaced with a 3 digit number (the sc_status value). If that doesn't resolve it, can you post your inputs.conf? ... View more

Hi, i think what you are looking for is called "Intermediate Forwarding" in the splunk world. Look at this little section in the docs: link There is not much documentation for this setup, but there are already some questions regarding this. For example: http://answers.splunk.com/answers/10429/is-there-an-example-configuration-available-for-an-intermediate-forwarding-configuration.html http://answers.splunk.com/answers/32446/universal-forwarder-is-not-working-as-an-intermediate-forwarder.html Greetings Tom ... View more