I'm new to Splunk. I just installed the WSOC app and I see four systems identified on the "About" tab, but I don't see any info in the login events tab nor any of the others? What am I missing? I am using universal forwarders on these systems.
Have you set macros required for searches to work, depending on which indexes the data is going into?
Go to Manage Apps, find Windows Security Operations Center and click on Set up.
In the setup you should define index(es) that the logs are going into, i.e:
After that everything should work automatically, no additional actions are required.