Guys,
I'm trying to set up Guardduty log collection, but so far I'm not successful.
I have a heavy forwarder that forwards logs to the indexer and the search head queries the data in the indexer.
I configured the add-ons on the necessary platforms (heavy forwarder and search head), I configured the accounts needed to forward the logs.
The logs are being sent via the SQS queue. The logs arrive at the indexer, but I can't get the dashboard populated (Splunk App for AWS and aws_guardduty).
On the dashboards, in the 'AccountID' menu, a message appears
"Search produced no results."
I also tried to configure via HEC, but there is an error message that it cannot connect to the platform.
Can someone help me?
