Splunk app for AD - no data

[simbasim]

I have Splunk Ent. 5.0.5 with the same version forwarders on four (4) domain controllers.

I'm running no firewalls internally, the forwarders are configured to push data to "splunk" which is the hostname for my inhouse splunk server.

However, I am not seeing ANYTHING pop up in the AD app.

I looked through the 10 common causes writeup and none of them apply to me. Splunk just acts like it isn't getting the data.

I did at the TA_Windows/DNS/Domain Controller folders into the local splunkuniversalforwarder folders.

What might be the problem? I can't get support to answer me, unfortunately.

[jbernt_splunk]

Hello.
More often than not, you will need to make sure the data is actually flowing in. Doing a quick "host=" where is one of your servers, will show what is actually getting forwarded into Splunk. If nothing is coming in, the problem resides on the forwarder. Also, as in the 10 most common issues, verifying each of those will help you isolate the problem.