none of the event types in eventtypes.conf under \Splunk\etc\apps\Splunk_for_ActiveDirectory\default\ work in search. For example if i search for "eventtype=wineventlog-security" i get "Unable to find an eventtype wineventlog-security" but if i instead search for the underlying search string "index=main source=WinEventLog:Security" i get a lot of events. it looks like all eventtypes under "splunk_TA_windows" are searchable but non of the eventtypes under plunk_for_ActiveDirectory.
What could be wrong
I solved it after a day of troubleshooting 🙂 the problem was that the eventtypes where only accessible inside the app in splunk web, but i used the standard searchapp for testing. after searching in the search app inside splunk app for active directory it works like a charm
I solved it after a day of troubleshooting 🙂 the problem was that the eventtypes where only accessible inside the app in splunk web, but i used the standard searchapp for testing. after searching in the search app inside splunk app for active directory it works like a charm
Sounds like in the search app you would just need to explicitly specify the index for the AD data. (index=x eventtype=y)
The TAs for Splunk App for Active Directory log events into one of three indices:
Hello. Have you restarted Splunk between removing/re-adding the Splunk for Active Directory app?
using btool i can see that settings from eventtypes.conf in \Splunk_for_ActiveDirectory\default are being consumed by splunk, how come i cannot search for those eventtypes??
previously i had the splunk app for windows installed, but i have deleted it today. could that cause any problems?