All Apps and Add-ons

Windows Security Operations Center: After installation, I see four systems identified on the "About" tab, but why don't I see any info in the login events tab or any others?

symnetwork
New Member

I'm new to Splunk. I just installed the WSOC app and I see four systems identified on the "About" tab, but I don't see any info in the login events tab nor any of the others? What am I missing? I am using universal forwarders on these systems.

0 Karma

bojanz
Communicator

Have you set macros required for searches to work, depending on which indexes the data is going into?
Go to Manage Apps, find Windows Security Operations Center and click on Set up.

In the setup you should define index(es) that the logs are going into, i.e:

index=windows

After that everything should work automatically, no additional actions are required.

Bojan

0 Karma
Get Updates on the Splunk Community!

Strengthen Your Future: A Look Back at Splunk 10 Innovations and .conf25 Highlights!

The Big One: Splunk 10 is Here!  The moment many of you have been waiting for has arrived! We are thrilled to ...

Now Offering the AI Assistant Usage Dashboard in Cloud Monitoring Console

Today, we’re excited to announce the release of a brand new AI assistant usage dashboard in Cloud Monitoring ...

Stay Connected: Your Guide to October Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...