- Community
- :
- Splunk Answers
- :
- Apps and Add-ons
- :
- All Apps and Add-ons
- :
- Re: App for windows infrastructure domain drop dow...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
App for windows infrastructure domain drop downs not populating among other
Domain controllers have a forwarder with the TA-Windows deployed via server class. Splunk App for Windows Infrastruture on the search head. We get wineventlog, some AD user record changes, logins, etc. However, Things like domain controller health and OU, nor domain drop downs in some dashboards are not populating. During the detect features configuration, Domains, Domain Controllers, and DNS do not get detected.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
No prerequisites were skipped. The splunk supporting add-on for active directory is installed on the search head
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Does the forwarder have SA-ldapsearch installed? It was not clear to me whether it was installed on the forwarder.
Domain controllers have a forwarder with the TA-Windows deployed via server class
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The universal forwarder on the domain controller does not have SA-ldapsearch, only app deployed is TA-windows. SA-ldapsearch is only on the search head.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Cool. That is great. Is there an indexer between the forwarder and the search head?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes, Currently, looking into the inputs.conf file from the TA-WIndows, As there are monitors that are disabled such as Directory service and File Replication service. If enabled, would that fix the problem?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Possibly. However, since the deployment has an indexer, if the indexer is used by the search head as search peer, SA-ldapsearch needs to be installed there as well if it is not already installed.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Splunk App for Windows Infrastructure needs the Splunk Supporting Add-on for Active Directory to get the domain specific data. Please refer to Configure the Splunk App for Windows Infrastructure for more details.
Were the prerequisite checks bypassed when the app was installed?
Index This | A sphere has three, a circle has two, and a point has zero. What is it?
Build Scalable Security While Moving to Cloud - Guide From Clayton Homes
Mission Control | Explore the latest release of Splunk Mission Control (2.3)
