Splunk App for Windows Infrastructure: inputlookup DomainSelector blank

[rmills1]

I've just setup Splunk App for Windows Infrastructure v1.4.2 (on Splunk v6.5.6) with Active Directory shipping in logs. Most of it seems to be working fine, except for pages that have the Domain drop down box don't work. I just get the message, Search produced no results.

Looking at the search for that drop down box, the first part of the command is |ad-domains. When I run that I get nothing back.
When I look up ad-domains macro, it starts with inputlookup DomainSelector. When I run that, it returns no results.

I checked, and DomainSelector.csv in the lookups folder does contain the correct data. And running |inputlookup DomainSelector.csv works as expected, returning the contents of the csv.

If I do |inputlookup EventCodes it works fine. The main difference I can find is in transforms.conf

[DomainSelector]
external_type = kvstore
collection = DomainSelector_collection
fields_list = host, DomainNetBIOSName, DomainDNSName, ForestName, Site

[EventCodes]
filename=EventCodes.csv
max_matches=1

DomainSelector is a collection, while EventCodes is just a .csv. This is going beyond my limited knowledge, so I'm hoping for some help. How do I get the inputlookup command to work for DomainSelector?

Thanks

[rmills1 · Accepted solution]

So I figured out my issue. I realized the kvstores were the problem. Once I learned a bit about kvstores, I checked file permissions and other stuff. Finally, I just ran the command

domain-selector-search|outputlookup DomainSelector

and discovered it worked. My kvstore was populated. So at that point I knew there was a permission issue. After more digging, I found out that you could view scheduled searches with

index=_internal sourcetype=scheduler | table _time user savedsearch_name status scheduled_time run_time result_count

That showed me that the jobs running to update my kvstores was running as the admin user. Sure enough, I didn't give the admin user the winfra-admin role, so it didn't have permissions to get the data in the first place. Once I did that, I waited for the jobs to run again, and everything was successful.

TL:DR - Make sure the admin user has the winfra-admin role.

[davidjohnbecket]

when you say "ran the command" what do you mean?

Im having the same issue...