FISMA Audit Index

[seanp]

I am trying to configure the FISMA application on a Splunk 4.3 installation using Windows. Specifically I am configuring the Audit Component on the Overview page as all three show No Results Found. When I view the FISMA_SG_audit_event index, it is shows an event count of 0. Does anyone know what audit logs this is coming from? Do I need to add something to the input.conf file or WMI.conf file? I am currently collecting the Application, Security, and System logs on the DCs via the Universal Forwarder.

Thanks

[piebob]

if you're talking about the "Splunk for Fisma" app (http://splunk-base.splunk.com/apps/44883/splunk-for-fisma) the Splunkbase page for the app says
"This app does not provide data inputs, extractions, or tags itself." and goes on to explain that you need to configure inputs yourself via other technology add-ons and ensure the data conforms to the Splunk Common Information Model.