Why is no Windows data showing in the Windows Security Operations Center app dashboards?

[tomisin]

I am a complete newbie. I have a Splunk Server 6.2 which performs indexing and runs on Windows 2008 R2 which has an Active Directory Domain Controller, and another Windows 2008 forwarding Windows logs too, however, the dashboards are not showing any data.

I basically just followed the installation guidelines for the Apps and didn't make any additional configuration changes. Is there anything else I need to do?

Thanks for your help.

[dx3sdenn]

Changing the default index from index=main to index=wineventlog in the app settings works for me.

[tomisin]

Thank you very much for the suggestion. This helped.

[Richfez]

By "helped", do you mean that dx3sdenn's suggestion was the answer? If so, can you "Accept" the answer dx3sdenn made? Even better, after you've done that convert your answer (the one I'm commenting on) to a comment under dx3sdenn's answer. Does that make sense?