How do you have OSSEC sending events to Splunk? Are you forwarding them via syslog, or is Splunk installed on the OSSEC server and indexing the alerts file directly? It sounds more like Splunk is getting the wrong value for ossec_server in the raw events, and using those to populate the lookup. Try running the following and see if you still get the wrong list: sourcetype=ossec OR sourcetype=ossec_alerts | stats count by sourcetype, ossec_server Also, be aware that once a server is in the lookup table, it will stay there indefinitely. Running the following search will reset the lookup: | inputlookup lookup_ossec_servers | where description="All OSSEC Servers" | outputlookup lookup_ossec_servers For the agent management screen, try to get the CSV issue sorted out first. Once that's right, see if version of 1.1.85 of the app resolves the remaining issue. ... View more