Did you end up getting this to work?
I had the same issue and was told I hadn't deployed the TA app to the deployments, so the universal forwarders weren't actually sending the right metrics to the msad index.
Check that you have copied the Windows TA and AD monitor apps into the deployment apps folder. Then check the inputs.conf to ensure you have the appropriate monitors enabled.
Once you've done that you can confirm you have the right indexes created - e.g. msad, and you should start to see data coming in.
Also you may need to restart the universal forwarder to apply the config.
cheers,
Ben
