All Apps and Add-ons

Splunk app for AD - no data

simbasim
New Member

I have Splunk Ent. 5.0.5 with the same version forwarders on four (4) domain controllers.

I'm running no firewalls internally, the forwarders are configured to push data to "splunk" which is the hostname for my inhouse splunk server.

However, I am not seeing ANYTHING pop up in the AD app.

I looked through the 10 common causes writeup and none of them apply to me. Splunk just acts like it isn't getting the data.

I did at the TA_Windows/DNS/Domain Controller folders into the local splunkuniversalforwarder folders.

What might be the problem? I can't get support to answer me, unfortunately.

0 Karma

jbernt_splunk
Splunk Employee
Splunk Employee

Hello.
More often than not, you will need to make sure the data is actually flowing in. Doing a quick "host=" where is one of your servers, will show what is actually getting forwarded into Splunk. If nothing is coming in, the problem resides on the forwarder. Also, as in the 10 most common issues, verifying each of those will help you isolate the problem.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!