topic Re: Quick question about AD app 'GroupType' does not exist [pic] in Dashboards & Visualizations

Quick question about AD app 'GroupType' does not exist [pic]

eafitt — Wed, 31 Oct 2012 14:22:58 GMT

Where is this error coming from? or is this problem within the AD app directory or something with my central splunk server?

http://www.freeimagehosting.net/oinp6

Re: Quick question about AD app 'GroupType' does not exist [pic]

ahall_splunk — Wed, 31 Oct 2012 14:54:21 GMT

It's something with your AD app install.

In default/transforms.conf, there is a stanza for GroupType - it basically converts the event type into a field GroupType that contains Security or Distribution. This is backed by a CSV file in lookups/

By default, this happens on your search head and it is passed down to indexers in the replication bundle if you have a separate indexer. However, it should just automatically be there. So, I believe the issue is in your install.

Re: Quick question about AD app 'GroupType' does not exist [pic]

eafitt — Wed, 31 Oct 2012 15:39:52 GMT

Ok I'll go back through the install. Also would there happen to be a video or better reference to deploying splunk app for AD? I've been through all the documents on splunk base as well as the readme within the app multiple times and still can't get it to work.

Re: Quick question about AD app 'GroupType' does not exist [pic]

ahall_splunk — Wed, 31 Oct 2012 16:56:16 GMT

Read the documentation on http://docs.splunk.com for detailed instructions on how to install the AD app.

Re: Quick question about AD app 'GroupType' does not exist [pic]

eafitt — Thu, 01 Nov 2012 14:57:38 GMT

Actually this error is coming up in every app that I have not just the AD app which I got working.

Re: Quick question about AD app 'GroupType' does not exist [pic]

ahall_splunk — Thu, 01 Nov 2012 17:52:25 GMT

Make sure the GroupType lookup is exported properly (go into Manager->Lookups and export it to system)

Re: Quick question about AD app 'GroupType' does not exist [pic]

eafitt — Fri, 02 Nov 2012 12:46:43 GMT

It is in the AD app, could it be something with the actual csv file?
http://www.freeimagehosting.net/s86fw