Just tracked down this same issue, the "cisco:estreamer:data" sourcetype is expecting the event_sec field for timestamp. There are a number of events that do not contain that field. sourcetype="cisco:estreamer:data" NOT event_sec="*" Also, this addon needs reworking to handle the FIELDALIAS behavior changes after 7.2.4 https://docs.splunk.com/Documentation/Splunk/8.0.1/ReleaseNotes/Fieldaliasbehaviorchange ... View more