Just installed this and configured the forwarder, but I'm getting the following error in Splunk.
Received event for unconfigured/disabled/deleted index=windefender with source="source::WinEventLog:Microsoft-Windows-Windows Defender/Operational" host="host::****" sourcetype="sourcetype::XmlWinEventLog:Microsoft-Windows-Windows Defender/Operational". So far received events from 1 missing index(es).
I manually created the Index, and I'm receiving logs but they are a jumbled mess I'm guessing since the SourceType is missing.
I'm sure I could fumble my way through creating the SourceType, but is there an easier way to get this setup?