Windows Security Operations Center: After installation, I see four systems identified on the "About" tab, but why don't I see any info in the login events tab or any others?

[symnetwork]

I'm new to Splunk. I just installed the WSOC app and I see four systems identified on the "About" tab, but I don't see any info in the login events tab nor any of the others? What am I missing? I am using universal forwarders on these systems.

[bojanz]

Have you set macros required for searches to work, depending on which indexes the data is going into?
Go to Manage Apps, find Windows Security Operations Center and click on Set up.

In the setup you should define index(es) that the logs are going into, i.e:

index=windows

After that everything should work automatically, no additional actions are required.

Bojan