Hi, The next Splunk Live event is tomorrow in London: https://live.splunk.com/london While there you are there you should also visit the syslog-ng booth and learn, how syslog-ng can provide you with a scalable log management layer in front of Splunk. Register for demo with my colleagues at https://www.syslog-ng.com/register/120335/ Bye, Peter Czanik (CzP) <peter.czanik@oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik