Quote from event collector docs: Channels are designed so that you assign a unique channel to each client that sends data to HEC. Each channel has a channel identifier (ID), which must be a GUID but can be randomly generated. You assign channel IDs simply by including them in requests as shown in the examples above. When the Splunk server sees a new channel identifier, it creates a new channel. What does this mean, exactly? If I have four different pieces of software, e.g. a Linux client program and a Windows client program, each of which log to Splunk, how many channel identifiers should I generate? The word “client” is quite ambiguous here... One per client software, Linux and Windows? One per released version of the softwares? One per actual client running the software? Does the channel parameter actually impact indexing or queries in any way? I don't understand why it's required at all. ... View more