How to get past "Check Data" screen in Splunk App for Windows Infrastructure without WinPrintMon data?

[DaClyde]

I finally got past the Active Directory stage on the Prerequisites screen and am now stuck on the "Check Data" screen. How to I disable the WinPrintMon option? My data center has no printers and thus has no printer-related information to monitor. However, I can't get past this step in the set up because it can't find any WinPrintMon data.

It really seems like this App could benefit from several options up front for choosing which items are needed (LDAP/AD, Print monitoring, perfmon, etc.), instead of expecting users to populate everything by default.

[jbernt_splunk]

Hi there. If you would, WinPrintMon should show as a Warning only, not an error. The key errors that are preventing you from moving on should be listed in addition to this WinPrintMon warning in the same section for the item that is not found.

[DaClyde]

Warning or not, I still don't have a Next button to click. I'll add some dummy data as suggested and see if that does the trick. I'm also missing WMI data, but I'm not sure what that's supposed to be or where it should live. That is also just a warning. So I have two warnings, no errors, but Next is grayed out.

[malmoore]

Can you also confirm that the Splunk Add-on for Windows and the Splunk Supporting Add-on for Active Directory have both been activated (not just installed)? Thanks.

[s2_splunk]

Hi DaClyde,
unfortunately, the app does not have a built-in way to skip data verification steps.
However, the only thing the app does is run a couple of searches for the relevant sourcetypes with a | head 5 at the end.
So if you create a dummy data file with at least five events and index it into a test index with the expected sourcetypes such that the validation searches can find them, you will be able to get past that hurdle.

Not pretty, agreed, but currently the only workaround.