Cisco eStreamer eNcore is grouping events as seen in the indexer when searched. The old eStreamer client did not do this.
It this normal behavior for certain events grouped together.
Any help would be appreciated. Splunk V6.5.2 Cisco devices are V6
↧