How do I configure the new Splunk App for Windows Infrstructure without all the data requirements?

[kjhanson]

I would like to make use of the latest release of the Splunk App for Windows Infrastructure, but it's not letting me past the initial configuration stage because I'm not collecting AD logs. But we are collecting other winevent logs that are useful. Does anyone know how to perhaps skip the "Check data coming from your environment" step?

[esix_splunk]

If you dont want to the trouble of setting up a DC and installing the TA on it, another possibility would be to setup a Splunk HF instance and install the windowsad TA's on it, and then install and enable EventGen on that box. That should simulate the events enough that it might fool the app into installing. I haven't tested this yet though, but in theory it should work.

EventGen
https://github.com/splunk/eventgen

Using EventGen - There are a few blog links in this series..
http://blogs.splunk.com/2013/07/31/an-easy-way-to-generate-sample-data/

If you try this, post the results here...

[malmoore]

Hi,

You are encountering a bug in this latest version which will be addressed in a future maintenance release.

For now, the quickest way to resolve the issue is to set up a domain controller, install a universal forwarder, deploy the TA add-on and collect a few events so that the check passes. Then, turn off the universal forwarder and proceed with using the app as normal.

We apologize for any inconvenience caused.