All Apps and Add-ons

How do I configure the new Splunk App for Windows Infrstructure without all the data requirements?

Path Finder

I would like to make use of the latest release of the Splunk App for Windows Infrastructure, but it's not letting me past the initial configuration stage because I'm not collecting AD logs. But we are collecting other winevent logs that are useful. Does anyone know how to perhaps skip the "Check data coming from your environment" step?

0 Karma

Splunk Employee
Splunk Employee

If you dont want to the trouble of setting up a DC and installing the TA on it, another possibility would be to setup a Splunk HF instance and install the windowsad TA's on it, and then install and enable EventGen on that box. That should simulate the events enough that it might fool the app into installing. I haven't tested this yet though, but in theory it should work.

EventGen
https://github.com/splunk/eventgen

Using EventGen - There are a few blog links in this series..
http://blogs.splunk.com/2013/07/31/an-easy-way-to-generate-sample-data/

If you try this, post the results here...

0 Karma

Splunk Employee
Splunk Employee

Hi,

You are encountering a bug in this latest version which will be addressed in a future maintenance release.

For now, the quickest way to resolve the issue is to set up a domain controller, install a universal forwarder, deploy the TA add-on and collect a few events so that the check passes. Then, turn off the universal forwarder and proceed with using the app as normal.

We apologize for any inconvenience caused.

0 Karma