Index, Source and SourceType Missing?

[mstolecki]

Just installed this and configured the forwarder, but I'm getting the following error in Splunk.

Received event for unconfigured/disabled/deleted index=windefender with source="source::WinEventLog:Microsoft-Windows-Windows Defender/Operational" host="host::****" sourcetype="sourcetype::XmlWinEventLog:Microsoft-Windows-Windows Defender/Operational". So far received events from 1 missing index(es).

I manually created the Index, and I'm receiving logs but they are a jumbled mess I'm guessing since the SourceType is missing.

I'm sure I could fumble my way through creating the SourceType, but is there an easier way to get this setup?

Thank you

[pdoconnell]

Is that being indexed from a UF version 6.2.0 or later? That is a prerequisite. Additionally, do you have Splunk_TA_windows installed on that device as well? I believe that is what creates the XmlWinEventLog intake tooling.

[mstolecki]

Splunk_TA_windows is installed. Using Version 7 of the Forwarder.