rorymcdonald87

[TCP Retransmission](https://wiki.wireshark.org/TCP-Retransmission) - Occurs when the sender retransmits a packet after the expiration of the acknowledgement. There is a firewall/connectivity issue it looks like to me

if I leave it default, no indexes are added to "selected indexes". If I add move any/all over from "available indexes", default changes to the first alphabetical one. Where do...

Ok. The link you sent returns "No results matched your search."?

Thank you

Hi, Your default token suggestion worked but only in part. The existing "known vendor" trend continues to work and the events land in the correct index. The simple log source...

[tcp_1024_ANON.zip](https://github.com/splunk/splunk-connect-for-syslog/files/9860576/tcp_1024_ANON.zip) see rows 10 onwards I completed the Chat groups google form but it is awaiting approval

I can see lots of SYN packets in the pcap but no SYN-ACK, ACK packets as part of the three-way handshake between source and destination. Should these logs still be...

I have tried this already without success