A-ha! OK that's better! So I've searched for 'index="forcepoint"' in the Search & Reporting App and can see data, but it seems bogus, as host=IP.addr.of.SMC, source=tcp:19997, sourcetype=key-value pairs, and that is if I have the Table view selected. If I have the List view selected, I can see more relevant data related what we need... I have a feeling that we haven't configured Splunk Ent. to break the event data accordingly. The data seems to arrive in a .xml format, as configured on the SMC server:  SYSLOG_CONF_FILE=<smc_install_dir>/data/fields/syslog_templates/fp-smc-log-fields-v1.xml I have also changed the sourcetype from 'key-value pairs' to 'syslog', so we'll just have to test and advise back. Alternatively if that doesn't work, I'll try the 'next-generation-firewall' in the sourcetype and give it a second try. Will let you know, thanks for now! If you have any other thoughts to share in the meanwhile, please let us know, it would be very much appreciated! ... View more

Hi, thanks for your reply! We've had successful three way TCP handshakes between our Forcepoint SMC and Splunk Enterprise (standalone) deployment, however no data that could be seen, as per this screenshot from the deployment guide: https://forcepoint.github.io/docs/ngfw_and_splunk/media/image9.png I'm not sure what you meant by "written to the proper index", I'm new to Splunk, however my guess would be that - yes, there is data written to the correct Index, as seen from the Splunk web UI > Settings > Data > Indexes > (name) forcepoint, (app) forcepoint-solutions, (event count) 41.9M, (home path) $SPLUNK_DB/forcepoint/db. We've also created a custom sourcetype - key-value pairs, as per the deployment guide do, mentioned above. "Does this app require any additional configuration to find the events?"  - Not sure, that's why I was hoping if someone with experience with this type of setup could advise, please. ... View more