https://community.splunk.com/t5/All-Apps-and-Add-ons/Install-and-Upgrade-of-Splunk-App-for-Windows-Infrastructure-1-0/m-p/133674#M11112 <P>Bug has been logged to review the issue --MSAPP-3142</P> Fri, 19 Sep 2014 23:25:24 GMT rbal_splunk 2014-09-19T23:25:24Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Install-and-Upgrade-of-Splunk-App-for-Windows-Infrastructure-1-0/m-p/133672#M11110 <P>rebuilt my Splunk server (version 6.1.3) and installed the Universal Forwarders with the TA for Windows deployed on all my Domain controllers. I see data coming in from Windows Security Eventlog into the index "WinEventLog".</P> <P>The Splunk App for Windows Infrastructure (1.0.2) is installed. It does not see the data from that index. Or at least I do not think it does. I tried modifying the winevents.conf file to select the correct indexes but must be doing something wrong.</P> <P>Also when I do the detect in the setup for the Splunk App for Windows Infrastructure it does not detect anything except Group Policy and Organizational Units.</P> Fri, 19 Sep 2014 22:03:14 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Install-and-Upgrade-of-Splunk-App-for-Windows-Infrastructure-1-0/m-p/133672#M11110 sat94541 2014-09-19T22:03:14Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Install-and-Upgrade-of-Splunk-App-for-Windows-Infrastructure-1-0/m-p/133673#M11111 <P>Found that issue was with lookup “DomainSelector.csv” as it wasn’t populated.<BR /> Logged in as use “admin” manually ran lookup search “DomainSelector_Lookup” (<CODE>domain-selector-search</CODE>|outputlookup DomainSelector.csv). It populated “DomainSelector_Lookup.csv” and all the App Menus are populated and all the AD Views started to work. After 15 minutes the scheduled lookup search ran and squashed out “ DomainSelector.csv”.</P> <P>To resolve the issue for “ admin role” added all App indexes (winevents, perfmon, msad) to be searched by default , and re-ran the build lookup tables command and now the drop downs are populated and the ldap search for things like disabled users are working.</P> Mon, 28 Sep 2020 17:38:37 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Install-and-Upgrade-of-Splunk-App-for-Windows-Infrastructure-1-0/m-p/133673#M11111 rbal_splunk 2020-09-28T17:38:37Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Install-and-Upgrade-of-Splunk-App-for-Windows-Infrastructure-1-0/m-p/133674#M11112 <P>Bug has been logged to review the issue --MSAPP-3142</P> Fri, 19 Sep 2014 23:25:24 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Install-and-Upgrade-of-Splunk-App-for-Windows-Infrastructure-1-0/m-p/133674#M11112 rbal_splunk 2014-09-19T23:25:24Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Install-and-Upgrade-of-Splunk-App-for-Windows-Infrastructure-1-0/m-p/133675#M11113 <P>Wouldn't it be better to add the specific indexes to the search or appropriate macro?</P> Sat, 20 Sep 2014 02:42:57 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Install-and-Upgrade-of-Splunk-App-for-Windows-Infrastructure-1-0/m-p/133675#M11113 jrodman 2014-09-20T02:42:57Z