See on my previous answer how to send all events to indexers. Then you could create that index definition to your hf without that it stores event on local hf. As I said it’s the best practices on distributed splunk environment. ... View more

Hi, I dealt with the identical issue. The only viable solution is to call an API. Or purchase Symantec's log parser exchange with a syslog output for SIEMS. This is purposely done. You can do so by following these steps: https://apidocs.securitycloud.symantec.com/#/doc?id=ses auth Generate an OAuth Key from the Symantec console in order to generate a bearer token with an expiration time for API calls. You have multiple alternatives, including Export Events and Export Stream Events, among others. The "Heavy Forwarder" server was what I used to execute these orders. The data can then be saved in a text file and parsed as desired. You can also design the Add-On yourself, but then you're responsible for its maintenance and updates... so it's not worth it. ... View more

In general, you can divide Splunk infrastructure into three layers. - Search Heads - if clustered they replicate some configuration between them within the cluster. Otherwise you use deployer to push configuration to them - Indexers - you use cluster master to push configuration - Forwarders - you use deployment server (sometimes you use deployment server to push configuration from DS to single search-heads or single indexers but that's a very unusual situation). There is no replication between layers as such. You could push from DS to deployer or cluster master but that's again - a very unusual situation. To make long story short - if you push something to a forwarder, it stays there. If you push something to search-heads, it's on search heads. And so on - you manage configuration on each layer separately. Oh, and you don't create indexes on HFs. Since HF only processes events and forwards events to indexers - you don't store events locally - you don't need indexes on HF. ... View more

Hi @jo54  You are correct change the event_type with MS 365 email logs for tag=email and alias it to receipient should work fine. ... View more