Splunk Add-on for CrowdStrike not collecting data.

[summitsplunk]

I've setup the Splunk Add-on for CrowdStrike using the guide found on splunkbase.

1) On the configuration tab II added my CrowdStrike account with the API UUID and Key that I found in the Crowdstrike GUI under support.

2) On the inputs tab I created an input

That's the only things the directions ask you to do but when I test to see if data is being collected I get noting.

index="crowdstrikeindex" sourcetype="crowdstrike:falconhost:json"

[ka_ng]

Is the Crowdstrike app installed on a search head cluster? Is the Crowdstrike add-on installed on the heavy forwarder? Did you only add inputs from the heavy forwarder? Did you call support to have data streaming authorized? These are all necessary steps to get CS data in.