topic Splunk App Windows Infrastructure upgrade - No "sourcetype="MSAD*" found in All Apps and Add-ons

Splunk App Windows Infrastructure upgrade - No "sourcetype="MSAD*" found

linusHillyard — Fri, 19 Dec 2014 02:18:34 GMT

I've recently upgraded to Splunk App for Windows Infrastructure 1.1.1 from version 1.0.4. Previously I had no issues with Active Directory data detection or Splunk App for Active Directory(SA-ldapsearch) version 2.0.1 and can still successfully search for queries like '|ldapsearch domain=DOMAIN search="(cn=Administrator)"'). Since the upgrade, when I run through the first-time setup wizard I get the error, "ERROR: Search "sourcetype="MSAD*" | head 5" did not return any events in the last 24 hours" when checking for data being provided by the environment.

I'm then provided with a link named, "Splunk Add-on for Microsoft Windows Active Directory for Splunk Universal Forwarder" however the link takes me to setup instruction for the Windows Infrastructure App. Since I'm still able to perform ldapsearch queries from the search app I'd assume the Splunk App for Active Directory is working correctly.

Also, when viewing the upgrade instruction(http://docs.splunk.com/Documentation/MSApp/1.1.1/MSInfra/UpgradetheSplunkAppforWindowsInfrastructure) you're instructed to download 'Splunk Supporting Add-on for Active Directory version 2.0.2 or later' however version 2.0.1 is the latest version I can currently find for download.

I'd appreciate any insight as I've hit a wall and cannot proceed with the upgraded version of the Windows Infrastructure app.

Re: Splunk App Windows Infrastructure upgrade - No "sourcetype="MSAD*" found

malmoore — Fri, 19 Dec 2014 06:44:35 GMT

Hi,

Have you made sure that the user that you log into Splunk Enterprise with has the 'winfra-admin' role? That role lets you search the proper default indexes that come with the app.

The Splunk Supporting Add-on for Active Directory is currently at version 2.0.1. The reference to 2.0.2 has been corrected. Apologies for any confusion.

Re: Splunk App Windows Infrastructure upgrade - No "sourcetype="MSAD*" found

linusHillyard — Fri, 19 Dec 2014 08:51:42 GMT

Yes, sorry. I should've stated the Prerequisites checks are all successful(green check marks). Also, I'm seeing no errors on the forwarders regarding the PS scripts used to collect AD info by the TA-DomainController-NT6 add on. Again, this application wias working correctly with the previous version Splunk App Windows Inf 1.0.4.

Re: Splunk App Windows Infrastructure upgrade - No "sourcetype="MSAD*" found

malmoore — Fri, 19 Dec 2014 19:16:43 GMT

Right, it's the data check that is failing.

Events with source type MSAD go into the 'msad' index by default.

Make sure that the 'winfra-admin' role searches the 'msad', 'perfmon', and 'winevents' roles by default.

In the Splunk system bar, select "Settings" > "Access controls." From there , click "Roles", then click "winfra-admin." Once you get to that page, scroll down to "Indexes searched by default." The three indexes I mentioned above should be in the "Selected Indexes" pane.

Re: Splunk App Windows Infrastructure upgrade - No "sourcetype="MSAD*" found

rmsit — Fri, 19 Dec 2014 22:46:03 GMT

I am having similar issues. I am not even monitoring Active Directory DCs but have installed the Splunk Supporting Add-on for Active Directory and setup a service account for LDAP functionality. I see data from the MSAD index but not a sourcetype. Data from the MSAD index has a sourcetype of "ActiveDirectory".

And yes, I have met all the prerequisites however setup is giving me "ERROR: Search "sourcetype="MSAD*" | head 5" did not return any events in the last 24 hours".

Re: Splunk App Windows Infrastructure upgrade - No "sourcetype="MSAD*" found

malmoore — Sat, 20 Dec 2014 00:33:44 GMT

The Splunk Supporting Add-on for Active Directory doesn't actually collect AD events. It performs LDAP queries against your AD DCs and returns events based on those queries. Those events have no source type.

But it seems like you might have enabled the Active Directory input when you installed the universal forwarder. This is because "ActiveDirectory" is the default source type that gets assigned to default admon inputs. It's important not to enable any inputs when you install the UF because the TAs that come with the Windows Infrastructure app will take care of collecting all that information with the right source type.

At this point it's best to just delete that data and then install the correct Active Directory add-on for your version of Windows Server into the universal forwarder that is on the domain controller. That way the data will be indexed correctly, and the app will see it.

Re: Splunk App Windows Infrastructure upgrade - No "sourcetype="MSAD*" found

rmsit — Sat, 20 Dec 2014 00:43:24 GMT

I do not need to monitor AD DCs in my environment and only have member servers with the UF and TA installed and configured. The admon input was enabled on my SH which I have disabled. How do I get Splunk App Windows Inf to find data with the MSAD sourcetype to complete the guided setup?

Re: Splunk App Windows Infrastructure upgrade - No "sourcetype="MSAD*" found

malmoore — Sat, 20 Dec 2014 00:57:06 GMT

Ah! Right. Yes, unfortunately that is a bug, and we'll be addressing it in a point release.

In the meantime, to get through setup, go ahead and deploy the Active Directory TA onto your SH to generate some dummy data. Once you have enough to get through setup (you only need about 5-10 events or so, turn it off.

Apologies for the inconvenience.

Re: Splunk App Windows Infrastructure upgrade - No "sourcetype="MSAD*" found

rmsit — Sat, 20 Dec 2014 01:26:46 GMT

That worked. I copied the TA-DomainController-NT6 app to the SH and I was able to complete the setup.

Thanks!

Re: Splunk App Windows Infrastructure upgrade - No "sourcetype="MSAD*" found

linusHillyard — Sun, 21 Dec 2014 12:18:39 GMT

This is exactly what I needed, thanks for the suggestion.

Re: Splunk App Windows Infrastructure upgrade - No "sourcetype="MSAD*" found

schultet — Tue, 23 Dec 2014 20:15:44 GMT

I have the same issue - what is the SH stand for. I am bit of a newbie. Thanks

Re: Splunk App Windows Infrastructure upgrade - No "sourcetype="MSAD*" found

schultet — Wed, 24 Dec 2014 14:40:12 GMT

I am guessing SH is Splunk Search Head server. I copied the TA-DomainController-NT6 but still get the same error. I have two DCs with the UF on them - I am only seeing some data forwarded from he First DC like password changes, unlocks and Administrator logons. The Splunk server is now reporting Administrator Logons, so I assume it is forwarding those. Any other ideas how to seed the MSAD search

Re: Splunk App Windows Infrastructure upgrade - No "sourcetype="MSAD*" found

rmsit — Wed, 24 Dec 2014 15:34:41 GMT

Which directory did you copy the TA-DomainController-NT6 folder to? Make sure it's copied to the etc\apps directory only on the Search Head. You will also have to install the Splunk Supporting Add-on for Active Directory (SA-LDAPSearch) and configure an account Spunk can use to query AD. Lastly, you will have to install the add-on on your DC universal forwarders. You can manually copy the folders to them, or use a deployment server - the preferred method.

Re: Splunk App Windows Infrastructure upgrade - No "sourcetype="MSAD*" found

dolejh76 — Wed, 24 Dec 2014 16:17:15 GMT

We had a similar issue - did you make sure that msad where default search indexes?

Re: Splunk App Windows Infrastructure upgrade - No "sourcetype="MSAD*" found

pmac22 — Wed, 24 Dec 2014 16:46:44 GMT

Hi all, thanks for the direction, I'm having the same issue but making progress. So now my DCs are sending to both index=msad and index=activedirectory but only the eventsource=msad is NOT working. My DCs are 2012R2 is this a powershell issue? I have the app installed and deployed on the DC but the eventsource=msad is still not coming in???

TIA!

Re: Splunk App Windows Infrastructure upgrade - No "sourcetype="MSAD*" found

rmsit — Wed, 24 Dec 2014 16:56:42 GMT

Yes, in the Windows Infra app, there is a separate TA for 2012 servers.
Go to http://docs.splunk.com/Documentation/MSApp/latest/MSInfra/DownloadandconfiguretheSplunkAdd-onsforActiveDirectory for more information.

Re: Splunk App Windows Infrastructure upgrade - No "sourcetype="MSAD*" found

pmac22 — Wed, 24 Dec 2014 17:10:18 GMT

I had the powershell add-on installed, but i needed my windows admin to tweak the powershell read/write. It's no working perfectly. Thank you!

Re: Splunk App Windows Infrastructure upgrade - No "sourcetype="MSAD*" found

schultet — Mon, 28 Sep 2020 18:30:07 GMT

I have all the apps installed in the correct directory on my SH (a single server used for Splunk) E:\Program Files\Splunk\etc\apps

on the SH, I have the SA-ldapsearch in the etc\apps directory. LDAP is configured with a domain admin user currently. I performed a test connection and it was successful.

I do have the same APPs installed on both Domain Controllers and one is forwarding events

Splunk_TA_windows
SplunkUniversalForwarder
TA-DNSServer-NT6
TA-DomainCOntrollerNT6

Both DCs are 64bit - one is 2012r2 the other DC that is not forwarding events is 2008R2

Re: Splunk App Windows Infrastructure upgrade - No "sourcetype="MSAD*" found

schultet — Fri, 26 Dec 2014 21:06:05 GMT

where do I check that setting?

Re: Splunk App Windows Infrastructure upgrade - No "sourcetype="MSAD*" found

malmoore — Sat, 27 Dec 2014 05:35:54 GMT

If you run Windows Server 2012R2, then you need to deploy the TA-DomainController2012R2 and the SA-ModularInput-Powershell add-ons to those DCs.