I have installed forwarder to a new Windows machine with default settings (with installed Splunk Add-on for Microsoft Windows and enabled WinEventLogs: system, security and Application). I see in Splunk (with installed Splunk Add-on for Microsoft Windows 4.8.0) that data is arrives, but I can't find any events in search with this host and even this host in hosts list. Even if I manually add settings to C:Program FilesSplunkUniversalForwarderetcsystemlocalinputs.conf
[WinEventLog://Security] disabled = 0 start_from = newest index = wineventlog
The most common reason for your problem is: you aren't looking in the right index. People often forget (I know I do) that your role might not automatically search a new index by default. And if it doesn't, the data won't show up in the data summary. The data summary only looks at indexes the user is allowed to search by defautlt. So try
and see what you get!