Right, you'll have to run through that process to get the LEM prepared to collect the raw logs or message cores.
Next, the relevant connectors need to be set to send raw data to the LEM. Either of these options will do it, but if you still want the normalized data, you should pick Alert, nDepth.
Last, you need to tell nDepth to search the raw messages. This toggle has moved around in different iterations of the console, but you'll want the mouse-over to say "Log Messages." In 5.6 and 5.7 it's in the top right corner near the Play button.
