MS Windows AD Objects - How to build Lookups?

heathramos · ‎03-22-2022

running the configuration wizard and trying to build the lookups

AD_Obj_Domain and AD_Obj_Admin_Audit work but the rest say: Warning: No admon events found - Change Sync Time Period

I followed the suggestions in Review - Recollecting the admon baseline data but it hasn't helped.

any ideas?

tshah-splunk · ‎03-23-2022

Try accelerating the data model present in the app. It'll help you generate the AD-related datasets and populate the dashboards. The name of the data model is MS_Windows_AD_Changes .

---
If you find the answer helpful, an upvote/karma is appreciated

heathramos · ‎03-23-2022

tried that and no change

anything else I can try?

MS Windows AD Objects - How to build Lookups?

configuration

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Automating Threat Operations and Threat Hunting with Recorded Future

Join the Conversation

MS Windows AD Objects - How to build Lookups?

configuration

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Automating Threat Operations and Threat Hunting with Recorded Future