All Apps and Add-ons

MS Windows AD Objects - How to build Lookups?

heathramos
Path Finder

running the configuration wizard and trying to build the lookups

AD_Obj_Domain and AD_Obj_Admin_Audit work but the rest say: Warning: No  admon events found - Change Sync Time Period

I followed the suggestions in Review - Recollecting the admon baseline data but it hasn't helped.

any ideas?

 

 

Labels (1)
Tags (2)
0 Karma

tshah-splunk
Splunk Employee
Splunk Employee

Hey @heathramos,

Try accelerating the data model present in the app. It'll help you generate the AD-related datasets and populate the dashboards. The name of the data model is MS_Windows_AD_Changes .

---
If you find the answer helpful, an upvote/karma is appreciated
0 Karma

heathramos
Path Finder

tried that and no change

anything else I can try?

0 Karma
Get Updates on the Splunk Community!

Index This | Why did the turkey cross the road?

November 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...