Install and Upgrade of Splunk App for Windows Infrastructure 1.0.3 does not show Data for Active Directory (Ad) Views.

[sat94541]

rebuilt my Splunk server (version 6.1.3) and installed the Universal Forwarders with the TA for Windows deployed on all my Domain controllers. I see data coming in from Windows Security Eventlog into the index "WinEventLog".

The Splunk App for Windows Infrastructure (1.0.2) is installed. It does not see the data from that index. Or at least I do not think it does. I tried modifying the winevents.conf file to select the correct indexes but must be doing something wrong.

Also when I do the detect in the setup for the Splunk App for Windows Infrastructure it does not detect anything except Group Policy and Organizational Units.

[rbal_splunk · Accepted solution]

Found that issue was with lookup “DomainSelector.csv” as it wasn’t populated.
Logged in as use “admin” manually ran lookup search “DomainSelector_Lookup” (domain-selector-search|outputlookup DomainSelector.csv). It populated “DomainSelector_Lookup.csv” and all the App Menus are populated and all the AD Views started to work. After 15 minutes the scheduled lookup search ran and squashed out “ DomainSelector.csv”.

To resolve the issue for “ admin role” added all App indexes (winevents, perfmon, msad) to be searched by default , and re-ran the build lookup tables command and now the drop downs are populated and the ldap search for things like disabled users are working.

[jrodman]

Wouldn't it be better to add the specific indexes to the search or appropriate macro?

[rbal_splunk]

Bug has been logged to review the issue --MSAPP-3142