In the environment:
Windows:Security, Windows:Application and Windows:System being logged on Windows servers and sent via Universal Forwarder and Splunk_TA_Windows (about 300 forwarders on windows servers).
Also a handful of Unix boxes with the Splunk_TA_Unix, maybe 2 that have Universal forwarders, but the rest of the unix systems report to a central syslog server.
Only seem to be getting in the Enterprise Security System Center and Update Center linux server data.
What populates System and Update Center from Splunk_TA_Windows?
According to the ES Dashboard Requirement Matrix
for Update Center tags : os AND update AND status(HotFixID OR package)
for System Center tags: os AND report AND version AND listening port
UPDATE: In ES the System Center is populated by the tag inventory and os, and the data model Inventory, not Application State
As shown here in the Compute Inventory Data Model CIM Inventory
Verify configuration:
Perform a search like this and look for hosts.
(tag=os AND tag=inventory)
System Center Endpoint Dashboard
Check Splunk_TA_Windows:
Make sure it is installed at the Recommended Splunk Add-on for Windows Component Installation Locations - Search Head,Indexer,Forwarder,Deploy. Serv.
Splunk_TA_Windows Docs Recommended Locations
Make sure the inputs that collect the information needed for Inventory and OS are enabled.
See. inputs.conf and wmi.conf
Splunk_TA_Windows Docs Configure Inputs
Check Data Model:
System Center dashboard data is derived from the Inventory data model and accelerated automatically.
To verify that authentication data is present, use this search:
| datamodel Inventory All_Inventory search
To verify that events are being accelerated by the data model correctly, use this search (be careful not
to search across all time):
| tstats summariesonly=true count from datamodel=Inventory by OS
According to the ES Dashboard Requirement Matrix
for Update Center tags : os AND update AND status(HotFixID OR package)
for System Center tags: os AND report AND version AND listening port
UPDATE: In ES the System Center is populated by the tag inventory and os, and the data model Inventory, not Application State
As shown here in the Compute Inventory Data Model CIM Inventory
Verify configuration:
Perform a search like this and look for hosts.
(tag=os AND tag=inventory)
System Center Endpoint Dashboard
Check Splunk_TA_Windows:
Make sure it is installed at the Recommended Splunk Add-on for Windows Component Installation Locations - Search Head,Indexer,Forwarder,Deploy. Serv.
Splunk_TA_Windows Docs Recommended Locations
Make sure the inputs that collect the information needed for Inventory and OS are enabled.
See. inputs.conf and wmi.conf
Splunk_TA_Windows Docs Configure Inputs
Check Data Model:
System Center dashboard data is derived from the Inventory data model and accelerated automatically.
To verify that authentication data is present, use this search:
| datamodel Inventory All_Inventory search
To verify that events are being accelerated by the data model correctly, use this search (be careful not
to search across all time):
| tstats summariesonly=true count from datamodel=Inventory by OS