All Apps and Add-ons

Index, Source and SourceType Missing?

mstolecki
Engager

Just installed this and configured the forwarder, but I'm getting the following error in Splunk.

Received event for unconfigured/disabled/deleted index=windefender with source="source::WinEventLog:Microsoft-Windows-Windows Defender/Operational" host="host::****" sourcetype="sourcetype::XmlWinEventLog:Microsoft-Windows-Windows Defender/Operational". So far received events from 1 missing index(es).

I manually created the Index, and I'm receiving logs but they are a jumbled mess I'm guessing since the SourceType is missing.

I'm sure I could fumble my way through creating the SourceType, but is there an easier way to get this setup?

Thank you

0 Karma

pdoconnell
Path Finder

Is that being indexed from a UF version 6.2.0 or later? That is a prerequisite. Additionally, do you have Splunk_TA_windows installed on that device as well? I believe that is what creates the XmlWinEventLog intake tooling.

0 Karma

mstolecki
Engager

Splunk_TA_windows is installed. Using Version 7 of the Forwarder.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!