One does not integrate a Universal Forwarder (UF) with Spunk Enterprise Security (ES).  The UF sends data to Splunk Enterprise to be indexed and ES reads that data.  The key is the data must be made CIM-compliant when onboarded.  CIM is Splunk's Common Information Model, which defines common field names for certain type of data.  A common set of names makes it much easier to correlate data from multiple sources.  ES relies heavily on CIM. Once you have your data onboarded and CIM-compliant, it's time to enable datamodel accelerations (DMAs).  DMAs make for faster searching and are another feature used heavily by ES.  In ES, select Configuration->CIM Setup.  For each data model appropriate to your data, check the Accelerate box and enter an index name in the Indexes box then click Save. ... View more