DNS, DHCP, IIS are done via SIEM collector, and you can only start getting the logs once data source is created on receivers. So I don't think auto learn applies to these above.
This is partially true.
In the options you can select syslog as retrieval and I confirm I got it working with third party tools when creating the datasource manually. I cannot figure out why it is not working with Autoloearn.
Right, ok. You might not be using a SIEM collector, just a syslog client on the server then...