Hi @DawidM, I don't see anything that may cause the issue. Could you please run and share below search outputs? Below will show buckets time/size/path info for demisto_poc index. Please run the search using  "All time" timerange; | dbinspect index=demisto_poc | convert ctime(*Epoch) | eval rawSizeMB=round(rawSize/1024/1024,2) | eval sizeOnDiskMB=round(sizeOnDiskMB,2) | table index bucketId startEpoch endEpoch rawSizeMB sizeOnDiskMB state path splunk_server | addcoltotals rawSizeMB sizeOnDiskMB  Below will show the frozenTimePeriodinSec setting on Indexers; | rest /services/properties/indexes/_internal/frozenTimePeriodInSecs   If this reply helps you an upvote is appreciated. ... View more

Check splunkbase (https://apps.splunk.com) for add-ons that will help you ingest the data from your firewalls and applications. Changes are they comply with the Common Information Model so the field names are well-known. ... View more