Hello, I have a SC4S server setup receiving info from our Network UPS.  I have created a new index for any date to do with our UPS in Splunk.  I went into the SC4S server and modified the compliance_meta_by_source.conf and compliance_meta_by_source.csv files.   When I add the entry for the new index the info stops coming to our Splunk environment.   If I remove it it starts coming over again.   What am I doing wrong.  If I leave the .splunk.index portion out the info goes over with the new source type and also creates the new field in splunk, but as soon as I add the index part the info stops going over.  Below is the info that I have put in both files. compliance_meta_by_source.conf filter f_powerware_ups { host("my ups IP address" type(glob)) }; compliance_meta_by_source.csv f_powerware_ups,.splunk.sourcetype,"powerware_ups" f_powerware_ups,fields.vendor,"Eaton" f_powerware_ups,.splunk.index,"netups"   ... View more

Hello, I am new to Splunk.  I have successfully got our SC4S server setup and sending info to Splunk.  I am working on getting data in from our Barracuda Web Filter.  The data is going in but getting assigned a source type of nix:syslog.  I have installed the BarracudaWebFilter app in Splunk but for it to work I am reading the sourcetype needs to be "barracuda".   I believe I need to add a line in the splunk_metadata.csv file on the SC4S server but not sure what it should be.  Anybody else set this up and have any info the could provide. Thanks, ... View more