Hi all,
I was wondering if Parent-Client datasources can be used for SIEM collector 11 datasources?
Under my receiver I would create a parent datasource called WINDOWS_COLLECTOR_EVENTLOG with the following settings:

The design would be to add all servers under WINDOWS_COLLECTOR_EVENTLOG, and if there server has multiple roles it will be added as well to for example parent data source WINDOWS_COLLECTOR_DHCP, this to catch if there's multiple types of datasources from 1 host. Our SIEM consultant told us that we could use non-routable IP addresses for parent data sources, so that's how we're currently setting up things..
Then at the clients tab I would like to add multiple servers, but to test I started with 1 data source:

for reference, the config on the server itself for the collector:

When it is added like this it's not working. When I work without the fictional IP on the parent (so just add it as a plain data source) it does work. What am I doing wrong to add collector sources as a client data source?
I tried leaving the host blank in the parent source but that also doesn't seem to help.Can I work only with parent client if this server does all the event collecton for all servers?
Thanks,
Nicolas