All Apps and Add-ons

Why is no Windows data showing in the Windows Security Operations Center app dashboards?

New Member

I am a complete newbie. I have a Splunk Server 6.2 which performs indexing and runs on Windows 2008 R2 which has an Active Directory Domain Controller, and another Windows 2008 forwarding Windows logs too, however, the dashboards are not showing any data.

I basically just followed the installation guidelines for the Apps and didn't make any additional configuration changes. Is there anything else I need to do?

Thanks for your help.

0 Karma

Engager

Changing the default index from index=main to index=wineventlog in the app settings works for me.

New Member

Thank you very much for the suggestion. This helped.

0 Karma

SplunkTrust
SplunkTrust

By "helped", do you mean that dx3sdenn's suggestion was the answer? If so, can you "Accept" the answer dx3sdenn made? Even better, after you've done that convert your answer (the one I'm commenting on) to a comment under dx3sdenn's answer. Does that make sense?

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!