You need to verify that Log Collection has been configured correctly, otherwise it might not work.
The following methods verify that Log Collection is working.
- Verify that there is event activity the Event Source Monitoring tab of the Administration > Health & Wellness view.
- Verify that there are parsers in the device.type field in the Details column in the Investigation > Events view for the collection protocol you configured.
Please refer to the Configuration Guide for each Collection Protocol for steps on how to verify that protocol is set up correctly.