Hi - I am trying to configure the authentication data model to include additional source data indexes. We want to include Duo logs in our dashboard in Splunk ES, but am unsure how to get the data model to recognize the new data.  The logs also appear to be in a different format, but I notice there's a method to "eval" the fields in the data model.  Can you please advise best practice for this?  Thanks. ... View more