Hi richgalloway 1st of all many thanks for your quick answer. Correct in this environment I belive that they have configured the UF as well as a syslog server. I need to confirm this though. Could you please give further details on the correct architeture for the UF and the log source ---> splunk flow ? I believe that what you mean in your second part of the answer is that the uf should be pointing and sending logs to the inderxers and later on when querying the sh, it will send the query to the indexers which will perform the dirty job, right ? and then indexers will send their output to the sh correct ? is that the right arch ? ... View more