It appears that according to the documentation, I should be able to configure Trend to forward all module events to Splunk via syslog, and then store it into a file and monitor that file with Splunk as an input, and that sourcetype is supposed to be "deepsecurity".   On the "details" page on Splunk's website for the app - it states this: "It is highly recommended that you follow the Splunk best practices for syslog, and that you configure rsyslog or syslog-ng to write syslog output to a file which can then be collected by a Splunk forwarder and sent to the Splunk server. You need to ensure that the Splunk forwarder sets the sourcetype to deepsecurity when forwarding events to a Splunk receiver."   I have an on-prem HF, and a Splunk Cloud Search Head.  The app is installed on the Search Head, and the HF is storing the trend data as "deepsecurity" sourcetype.  Then, what's supposed to happen (to my understanding) is the app is configured to rewrite the sourcetype field to the appropriate module.   Ex:  deepsecurity -> deepsecurity-antimalware   The problem -------------------------- Search Head gets the data and the app never rewrites the sourcetype, so everything is being seen as "deepsecurity" and none of the dashboard panels populate.   What am I doing wrong?  Do I need the Trend app on my HF as well?  The HF doesn't index anything. ... View more