topic Re: issues with splunk app for active directory in All Apps and Add-ons

issues with splunk app for active directory

freeborn — Thu, 05 Jul 2012 17:03:16 GMT

I cant seem to run any reports within the splunk app for active directory.

For instance if I run user logon failures i get "Lookup table 'HostInfo' is empty."

Administrator audit: I get Lookup table 'HostInfo' is empty. and Lookup table 'tSessions' is empty.

Any help is appreciated since I am trying to set this up to present prior to purchasing.

Re: issues with splunk app for active directory

ahall_splunk — Thu, 05 Jul 2012 18:32:23 GMT

The tHostInfo and tSessions tables are generated by saved searches that run on a five minute schedule. There are a couple of reasons why they would not be shown:

You have not turned on Audit on all your domains as described in the setup documentation
You are running Admin Audit with a search period that is less than five minutes
You have a more complex environment and your saved searches are not generating the files in the right place (unlikely if you are using the free version - this is more common in complex multi-search-head environments)
For some reason, the saved search is not firing (also uncommon)

I suspect #1 is the culprit. If you don't enable audit, then successful logons don't get recorded, and the tSessions and tHostInfo look ups will be empty as a result of no events.

Re: issues with splunk app for active directory

freeborn — Thu, 05 Jul 2012 18:37:34 GMT

- I did and I have confirmed
not sure what you mean (trying my search for a 24hr period if thats what you mean)
not the case
Possible this is it but I dont know how to verify

Thanks in advance

Re: issues with splunk app for active directory

ahall_splunk — Thu, 05 Jul 2012 19:02:01 GMT

I've just had another report of the tHostInfo table being broken, and I am investigating. It doesn't happen on my system, so any information you can provide on your AD environment would be appreciated.

Re: issues with splunk app for active directory

freeborn — Mon, 09 Jul 2012 13:56:30 GMT

Ahall_splunk...if you would like to have a look at my install...let me know. Our temp license runs to July 20th and I am trying to prove a POC to purchase.

Re: issues with splunk app for active directory

ahall_splunk — Mon, 09 Jul 2012 14:05:39 GMT

Get in touch with your Splunk sales team and ask them to get me involved. We'll get something sorted.

Re: issues with splunk app for active directory

lfcowart — Wed, 05 Sep 2012 03:42:46 GMT

Adrian, was there a solution to this problem? I am also having the same issue. I did verify also that my auditing matches the documentation.

Re: issues with splunk app for active directory

ahall_splunk — Wed, 05 Sep 2012 16:20:36 GMT

I have yet to be involved in this particular request.

Re: issues with splunk app for active directory

kelvinlow — Tue, 02 Oct 2012 06:15:00 GMT

hi, I'm getting the same error too but no solution yet. Could anyone share?

Re: issues with splunk app for active directory

ahall_splunk — Tue, 02 Oct 2012 14:23:51 GMT

Please open up a new issue / answers - your situation may be different. Don't forget to include what version of the app you are running, what version of windows, what version of splunk, etc.

Re: issues with splunk app for active directory

eljaybee — Fri, 14 Feb 2014 12:39:03 GMT

I'm getting the same issue as stating in this post. Can someone help me?