I suspect if you look again, you'll see quite clearly that your view is specifying that both a SimpleResultsTable module and a Table module should be there. ... View more

If you are using the UNIX app, the data will be going into index=os Try this search index=* | stats count by host sourcetype source ... View more

thanks piebob ... View more

awesome.. thanks for the reply.. Will work witht he deployment monitor and the query you have provided. 🙂 ... View more

Hey Takajian, Thanks for your reply. I am aware of the outputs.conf configuration that you've mentioned above. I was interested to know if the same could be achieved from a command line so that I did not have to go and edit the conf file after installing the universal forwarder.. Thanks again ... View more