I'm a little fuzzy on understanding this one, is that one event? It might help (me and others) to see what three events would like like from this source. I'm sure we can figure it out 🙂 ... View more

Since this is for a dashboard, your easiest option is to use a lookup table. It sounds like you know what the mapping is between the name Company_ABC and the host from which the data came from. You can just dump that into a csv file and call the lookup based on "host" at search time. You need not insert it at index time. If you absolutely must insert it at index time, your only option is to do this at the indexer upon data arriva using a transforms stanza to insert the Company_ABC name; this approach is generally not recomended, but if you must have it that way, then use the transform. ... View more

Hi Laura, Login to your Splunk instance through a browser. Click on Manager > Access Controls > Roles > New, and you can create a role that limits access to indexes. You will find a list of all the available indexes, so you can pick what you want. ... View more

You don't need to explicitly tell the forwarder to send the host name of the machine from where the data is coming from. Splunk handles that by default. The field name is "host". So for example, if you wanted to see a full listing of al the hosts that are sending data to your Indexers, you can execute a query like this: index=* | dedup host | table host ... View more