All Apps and Add-ons

How do I configure the new Splunk App for Windows Infrstructure without all the data requirements?

kjhanson
Path Finder

I would like to make use of the latest release of the Splunk App for Windows Infrastructure, but it's not letting me past the initial configuration stage because I'm not collecting AD logs. But we are collecting other winevent logs that are useful. Does anyone know how to perhaps skip the "Check data coming from your environment" step?

0 Karma

esix_splunk
Splunk Employee
Splunk Employee

If you dont want to the trouble of setting up a DC and installing the TA on it, another possibility would be to setup a Splunk HF instance and install the windowsad TA's on it, and then install and enable EventGen on that box. That should simulate the events enough that it might fool the app into installing. I haven't tested this yet though, but in theory it should work.

EventGen
https://github.com/splunk/eventgen

Using EventGen - There are a few blog links in this series..
http://blogs.splunk.com/2013/07/31/an-easy-way-to-generate-sample-data/

If you try this, post the results here...

0 Karma

malmoore
Splunk Employee
Splunk Employee

Hi,

You are encountering a bug in this latest version which will be addressed in a future maintenance release.

For now, the quickest way to resolve the issue is to set up a domain controller, install a universal forwarder, deploy the TA add-on and collect a few events so that the check passes. Then, turn off the universal forwarder and proceed with using the app as normal.

We apologize for any inconvenience caused.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...