Does Splunk Security Essentials use the Windows_TA to get its data?
When I have Splunk_TA_windows enabled and I run the data source check, I get the following error:
This search requires Windows Security data to run. If it is not present, consider ingesting it via the Splunk Universal Forwarder.
When I disable Splunk_TA_windows, that error is gone, but it tells me I dont have a user field defined and need Splunk_TA_windows to do that.,Does Splunk Security Essentials want me to have the Windows_TA installed?
Having some issues where SSE is not showing that I have events for 'sourcetype="*wineventlog:Security"', but I have millions of windows events.
