Thankyou @isoutamo the "Splunk Enterprise" => Splunk UF is precisely why it's confusing 🙂   I'll go back and have another read through those docs. ... View more

I'm still googling this question, as it's still not clear in the docs, but neither of these links work anymore! ... View more