Hi ! I am facing the same issue getting windows logs and sysmon logs but not getting any Linux and zeek logs . Using this inputs.conf file and all settings followed per documentation credneial package installed sucessfully as well. Also installed Zeek Apps as well. Sorry forgot to mention that seeing hosts when do index=_internal search last 24 hours.    Any help please ? default] host = zeek-VirtualBox [monitor:///var/log/messages] disabled = 0 index = unix [monitor:///var/log/syslog] disabled = 0 index = unix [monitor:///var/log/faillog] disabled = 0 index = unix [monitor:///var/log/auth.log] disabled = 0 index = unix [monitor:///opt/zeek/log/current] disabled = 0 _TCP_ROUTING = * index = zeek sourcetype = bro:jason whitelist = \.log$ ... View more

Hi @gcusello  thanks for you reply and help . Yes i did the followings: 1- Installed sysmon on my PC  2- Installed Splunk forwarder on my PC  3- Configured the inputs.conf by copying to  4- Alread created index=winpc index on splunk  5- Dont see my PC / hostname from index=_internal logs last 30 days only see splunk hostname 6- Do I need to install universal forwarder credentail packge i tried but its fails when try to run the given comand here on : https://docs.splunk.com/Documentation/Forwarder/9.1.0/Forwarder/ConfigSCUFCredentials#Install_the_forwarder_credentials_on_individual_forwarders_in_Windows 7- My splunk unversal forwarder was installed to C:\Program Files\SplunkUniversalForwarder and service is running.        ... View more