Great - will give this a try later this week. I'm struggling with the same thing.   Two questions: (1) - How would that look like with a forwarder installed on another system then the indexer? (2) - What would it take to have flow records accepted for both - UDP and TCP?   Cheers - Will ... View more

The root user is the only truly universal user on any Linux machine so it's not in the learnt identities but the static identities lookup (https://github.com/doksu/splunk_auditd/blob/master/TA-linux_auditd/lookups/posix_identities.csv), and they get merged together automatically. Best check your static identities lookup to ensure it has root in it. ... View more

Thanks @pkt_nspktr  I combined your approach with @hansb and I finally got it working! Great work, and thank you so much for sharing! Regards, Dave ... View more