Configuração Splunk App for Windows Infraestructure - Dados para Dominio não são encontrados

[unimedcba]

Foi realizado a instalação do Splunk Infraestructure, com os pré-requisitos todos validados e realizado os deploy para os servidores de active Directory

Porém ao realizar a detecção dos recursos os controladores de Dominios não são encontrados. Não consegui achar um post no forum para resolver esta situação.

[unimedcba]

hi, undestand, the problem is the data of Active Directory - Domain Control not show, same the indicators config show sucess, according image in top post. But search in index=msda, data are showing

[gcusello]

Hi unimedcba,
could you re edit your question in english?
Anyway, I'm latin (Italian) so your language isn't so different from mine!
If I correctly understood, you installed AD TAs but you don't see data.
Run this search: index=msad
if you have results, it means that data are arriving but your searches doesn't see them probably because they are out od the default search path.
In this case, you can add msad index to the default search path or modify the search that creates lookups inserting also the condition index=msad.
If you don't see data, you have to troubleshoot your architecture.

Bye.
Giuseppe

[gcusello]

As I said, you already are receiving data on you indexers, so the problem is in the scheduled searches to populate lookups because the msad index is out of default search path and in the macros and eventtype usually there isn't the filer on index (index=msad).
You have to ways:

• modify default search path
• modify macros and eventtypes in App

The first solution is easier:

• search in your App the search to populate lookup ([Settings -- Searches, Reports and Alerts],
• see the owner of the scheduled searches (probably Admin),
• go in [Settings -- Access Control -- Users] and see the roles of the App Owner (probably Admin),
• go in [Settings -- Access Control -- Roles -- Indexes] and add msad index to modify the Role you found (probably Admin) inserting a flag on"Included" and "Default",
• then rebuild lookups.

in this way your lookups should be populated with your data.

Bye.
Giuseppe

P.S.: to answer to my comment, add a new comment to this answer, don't insert a new anwser.

[unimedcba]

Thanks for you

[gcusello]

Hi unimedcba,
if you're satisfied of this answer, please accept and/or upvote it.
Bye, see next time.
Giuseppe