According to the ES Dashboard Requirement Matrix
for Update Center tags : os AND update AND status(HotFixID OR package)
for System Center tags: os AND report AND version AND listening port
UPDATE: In ES the System Center is populated by the tag inventory and os, and the data model Inventory, not Application State
As shown here in the Compute Inventory Data Model CIM Inventory
Verify configuration:
Perform a search like this and look for hosts.
(tag=os AND tag=inventory)
System Center Endpoint Dashboard
- Tag the data with "os" AND "inventory"
- Make sure your hosts that you want to see in System Center are being tagged
- tags are set to data that has been parsed with Splunk_TA_Windows and Splunk_TA_Nix deployed on the Universal Forwarder
Check Splunk_TA_Windows:
Make sure it is installed at the Recommended Splunk Add-on for Windows Component Installation Locations - Search Head,Indexer,Forwarder,Deploy. Serv.
Splunk_TA_Windows Docs Recommended Locations
Make sure the inputs that collect the information needed for Inventory and OS are enabled.
See. inputs.conf and wmi.conf
Splunk_TA_Windows Docs Configure Inputs
Check Data Model:
System Center dashboard data is derived from the Inventory data model and accelerated automatically.
To verify that authentication data is present, use this search:
| datamodel Inventory All_Inventory search
To verify that events are being accelerated by the data model correctly, use this search (be careful not
to search across all time):
| tstats summariesonly=true count from datamodel=Inventory by OS
