All Apps and Add-ons

MS Windows AD Objects - How to build Lookups?

heathramos
Path Finder

running the configuration wizard and trying to build the lookups

AD_Obj_Domain and AD_Obj_Admin_Audit work but the rest say: Warning: No  admon events found - Change Sync Time Period

I followed the suggestions in Review - Recollecting the admon baseline data but it hasn't helped.

any ideas?

 

 

Labels (1)
Tags (2)
0 Karma

tshah-splunk
Splunk Employee
Splunk Employee

Hey @heathramos,

Try accelerating the data model present in the app. It'll help you generate the AD-related datasets and populate the dashboards. The name of the data model is MS_Windows_AD_Changes .

---
If you find the answer helpful, an upvote/karma is appreciated
0 Karma

heathramos
Path Finder

tried that and no change

anything else I can try?

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...