Hi All! We have a setup where the servers sends their audit logs to a central log server (named syslog.a.b) (where also Splunk sits), through the audisp-remote plugin. So at the central log server there is an AuditD daemon which listen to a port, and throws every incoming auth log to a SINGLE file. Every entry begins with node=X type=... or node=Y type... This file is chewed (correctly) by Splunk... meaning the search "sourcetype=linux:audit node=X*" shows all auth logs coming from server X But the "Linux Auditd" app "sees"/shows only the local server (syslog.a.b) [no other hosts are available] I tried several times the "configure" tab, it detects only the syslog.a.b host ... I tried to clean up and reinstall, still not working. Where I should look for? Any hints are welcome 😉 Thanks! PS: so single Splunk Enterprise installation, latest version (v6.5.2) ... View more