topic Splunk App for Windows Infrastructure AD issue in All Apps and Add-ons

Splunk App for Windows Infrastructure AD issue

zwillis24 — Sun, 06 Apr 2014 20:10:13 GMT

I'm trying to get the Splunk App for Windows Infrastructure working (works for windows events but nothing else) and I'm running into some problems with AD. I believe I have everything setup correctly. I can search AD, for example, |ldapsearch domain=DOMAIN search="(cn=Administrator)" returns a result. However, when I do this search eventtype=msad-dc-health it returns nothing. And when I try to run one of the macros, like domain-list|dedup host|outputlookup DomainList.csv, it returns Error in 'SearchParser': Could not find macro 'domain-list' that takes 0 arguments. Expecting stanza name 'domain-list'. What am I doing wrong? I've also tried the legacy AD app without success. All the prerequisites appear to be met. Nothing ever populates in the apps AD queries. Thanks.

Re: Splunk App for Windows Infrastructure AD issue

dbylertbg — Fri, 11 Apr 2014 20:04:25 GMT

Have you deployed the TAs for active directory monitoring?

Specifically: TA-DNSServer-NT5 TA-DNSServer-NT6 TA-DomainController-2012R2 TA-DomainController-NT5 TA-DomainController-NT6 (as appropriate)

Re: Splunk App for Windows Infrastructure AD issue

zwillis24 — Fri, 11 Apr 2014 22:50:37 GMT

Thanks for the reply. I do have those setup in local folders... I think correctly. Any reason why I would be getting this error Error in 'SearchParser': Could not find macro 'domain-list' that takes 0 arguments. Or anything else you can think of that I might be missing? I went through the setup docs very closely. Thanks!

Re: Splunk App for Windows Infrastructure AD issue

dwithers — Wed, 16 Apr 2014 12:26:26 GMT

have you verified your ldapsearch is working properly? Specifically the SA-ldapsearch addon required?

Re: Splunk App for Windows Infrastructure AD issue

zwillis24 — Wed, 16 Apr 2014 18:29:23 GMT

I did. That is working fine. I can search AD and AD changes are being indexed.

Re: Splunk App for Windows Infrastructure AD issue

zwillis78 — Thu, 24 Apr 2014 09:35:50 GMT

Fix by Splunk support. There was an issue with the newest version of the Active Directory app.