True, in this case it's universal forwarders sending the logs, that we don't manage, which is the only reason why they suggested deploying a TA at the indexer level.  They might want the custom sourcetype changed to a standardized one. Hmm also thank you, since I haven't seen anything for the splunk admin course to suggest it goes through that level and either does the udemy course.  I might retake the udemy course as a refresher then schedule the splunkcloud course since there's been talk of us migrating to it so the splunkcloud course would be more practical. thanks ... View more