Enterprise Security - System Center or Update Center only have linux system data not windows systems.

[mcronkrite]

In the environment:
Windows:Security, Windows:Application and Windows:System being logged on Windows servers and sent via Universal Forwarder and Splunk_TA_Windows (about 300 forwarders on windows servers).
Also a handful of Unix boxes with the Splunk_TA_Unix, maybe 2 that have Universal forwarders, but the rest of the unix systems report to a central syslog server.

Only seem to be getting in the Enterprise Security System Center and Update Center linux server data.

What populates System and Update Center from Splunk_TA_Windows?

[mcronkrite · Accepted solution]

According to the ES Dashboard Requirement Matrix
for Update Center tags : os AND update AND status(HotFixID OR package)

for System Center tags: os AND report AND version AND listening port

UPDATE: In ES the System Center is populated by the tag inventory and os, and the data model Inventory, not Application State
As shown here in the Compute Inventory Data Model CIM Inventory

Verify configuration:

Perform a search like this and look for hosts.
(tag=os AND tag=inventory)

System Center Endpoint Dashboard

• Tag the data with "os" AND "inventory"
• Make sure your hosts that you want to see in System Center are being tagged
• tags are set to data that has been parsed with Splunk_TA_Windows and Splunk_TA_Nix deployed on the Universal Forwarder

Check Splunk_TA_Windows:
Make sure it is installed at the Recommended Splunk Add-on for Windows Component Installation Locations - Search Head,Indexer,Forwarder,Deploy. Serv.
Splunk_TA_Windows Docs Recommended Locations

Make sure the inputs that collect the information needed for Inventory and OS are enabled.
See. inputs.conf and wmi.conf
Splunk_TA_Windows Docs Configure Inputs

Check Data Model:
System Center dashboard data is derived from the Inventory data model and accelerated automatically.
To verify that authentication data is present, use this search:
| datamodel Inventory All_Inventory search

To verify that events are being accelerated by the data model correctly, use this search (be careful not
to search across all time):

| tstats summariesonly=true count from datamodel=Inventory by OS