Hi  Need help.  I have a Splunk setup environment which is using Splunk version 8.2  with Cisco Firepower eStreamer service (Splunk Add-On) version 5 and  Splunk Add-on for Carbon Black 2.1 (latest) .  It working wrongly in Splunk ver 8 which is parse error , those event having parse error and unable to identify key fields for events.  Not sure what cause this or missing any setting.  I follow the guideline  from https://www.cisco.com/c/en/us/td/docs/security/firepower/670/api/eStreamer_enCore/eStreamereNcoreSpl... and Splunk doc  (invalid link) I have been through all articles in community and as well that similar to the error, but no luck.  Any advice on getting this working is much appreciated.  Thank you.    Below is the setup info.  Cisco Firepower eStreamer service (Splunk Add-On) version 5 Issue : CISCO Firepower parsing issue: Device Model: Cisco Firepower 1010 Firewall Collecting method: Syslog to Splunk HF > Indexer Splunk Add-on installed on both HF and SH: https://splunkbase.splunk.com/app/3662 (Latest Version) Splunk HF and SH Version: 8.2.1 Source Type: cisco:firepower:syslog Source Type configuration: Tried Auto and Regex as well   Splunk Add-on for Carbon Black 2.1 (latest)  Meantime, it happen same to the CarbonBlack bit9 json parsing issue: Issue : Multiple events were merged by Splunk hence failed to parse, some of the event are without any issue though. Checked raw logs has no different patterns and tried to save the raw logs to text file and upload manually, it works without any problem. Collecting method: UF > Indexer Splunk Add-on installed: https://splunkbase.splunk.com/app/2790 (Latest Version) Splunk HF and SH Version: 8.2.1 Source Type: bit9:carbonblack:json Source Type configuration: Tried Auto and Regex as well ... View more