All Apps and Add-ons

Index, Source and SourceType Missing?

mstolecki
Engager

Just installed this and configured the forwarder, but I'm getting the following error in Splunk.

Received event for unconfigured/disabled/deleted index=windefender with source="source::WinEventLog:Microsoft-Windows-Windows Defender/Operational" host="host::****" sourcetype="sourcetype::XmlWinEventLog:Microsoft-Windows-Windows Defender/Operational". So far received events from 1 missing index(es).

I manually created the Index, and I'm receiving logs but they are a jumbled mess I'm guessing since the SourceType is missing.

I'm sure I could fumble my way through creating the SourceType, but is there an easier way to get this setup?

Thank you

0 Karma

pdoconnell
Path Finder

Is that being indexed from a UF version 6.2.0 or later? That is a prerequisite. Additionally, do you have Splunk_TA_windows installed on that device as well? I believe that is what creates the XmlWinEventLog intake tooling.

0 Karma

mstolecki
Engager

Splunk_TA_windows is installed. Using Version 7 of the Forwarder.

0 Karma
Get Updates on the Splunk Community!

Platform Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestIntroducing Splunk Edge Processor, simplified data ...

Enterprise Security Content Updates (ESCU) - New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 3 releases of new content via the Enterprise ...

Thought Leaders are Validating Your Hard Work and Training Rigor

As a Splunk enthusiast and member of the Splunk Community, you are one of thousands who recognize the value of ...