Hi! I'm new to splunk, I'm just learning it now because I need to understand the splunk search string given to me by the client (i'm an auditor) So I have a few questions with this splunk search string, I hope you could maybe help me 🙂 1. what does "index=*", in the index=* sourcetype=WinEventLog:Application OR source=WinEventLog:Application  SourceName="Application Name". And also I understand that in the source type, it is how the splunk will read the data (is that right?), I was also wondering why there is no "OR" before the SourceName? 2. Also if I fetch data from the event logging of the application, do I get the "Message" of that application? 3. How do I know which host the data is from? I did my research but I can't fully grasp the concept just yet. Thank you! ... View more