All Apps and Add-ons

MS Windows AD Objects - How to build Lookups?

Path Finder

running the configuration wizard and trying to build the lookups

AD_Obj_Domain and AD_Obj_Admin_Audit work but the rest say: Warning: No  admon events found - Change Sync Time Period

I followed the suggestions in Review - Recollecting the admon baseline data but it hasn't helped.

any ideas?



Labels (1)
Tags (2)
0 Karma

Splunk Employee
Splunk Employee

Hey @heathramos,

Try accelerating the data model present in the app. It'll help you generate the AD-related datasets and populate the dashboards. The name of the data model is MS_Windows_AD_Changes .

If you find the answer helpful, an upvote/karma is appreciated
0 Karma

Path Finder

tried that and no change

anything else I can try?

0 Karma
Get Updates on the Splunk Community!

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...