Here's the reason https://docs.splunk.com/Documentation/Splunk/9.0.0/DistSearch/Configuredistributedsearch only monitoring console should have other search heads peered. ... View more

Hi, enable the invocation headers via GPO or windows registers and the PS will add the timestamps as they show in your post. Google it, or use this article https://www.fireeye.com/blog/threat-research/2016/02/greater_visibilityt.html ... View more