Just installed this and configured the forwarder, but I'm getting the following error in Splunk.
Received event for unconfigured/disabled/deleted index=windefender with source="source::WinEventLog:Microsoft-Windows-Windows Defender/Operational" host="host::****" sourcetype="sourcetype::XmlWinEventLog:Microsoft-Windows-Windows Defender/Operational". So far received events from 1 missing index(es).
I manually created the Index, and I'm receiving logs but they are a jumbled mess I'm guessing since the SourceType is missing.
I'm sure I could fumble my way through creating the SourceType, but is there an easier way to get this setup?
Is that being indexed from a UF version 6.2.0 or later? That is a prerequisite. Additionally, do you have Splunk_TA_windows installed on that device as well? I believe that is what creates the XmlWinEventLog intake tooling.