Splunk app for active directory event types not working

[systemsatpayzon]

none of the event types in eventtypes.conf under \Splunk\etc\apps\Splunk_for_ActiveDirectory\default\ work in search. For example if i search for "eventtype=wineventlog-security" i get "Unable to find an eventtype wineventlog-security" but if i instead search for the underlying search string "index=main source=WinEventLog:Security" i get a lot of events. it looks like all eventtypes under "splunk_TA_windows" are searchable but non of the eventtypes under plunk_for_ActiveDirectory.

What could be wrong

[systemsatpayzon · Accepted solution]

I solved it after a day of troubleshooting 🙂 the problem was that the eventtypes where only accessible inside the app in splunk web, but i used the standard searchapp for testing. after searching in the search app inside splunk app for active directory it works like a charm

[sdaniels]

Sounds like in the search app you would just need to explicitly specify the index for the AD data. (index=x eventtype=y)

The TAs for Splunk App for Active Directory log events into one of three indices:

• perfmon = All performance data
• winevents = All Windows Event Log data
• msad = Everything else

[jbernt_splunk]

Hello. Have you restarted Splunk between removing/re-adding the Splunk for Active Directory app?

[systemsatpayzon]

using btool i can see that settings from eventtypes.conf in \Splunk_for_ActiveDirectory\default are being consumed by splunk, how come i cannot search for those eventtypes??

[systemsatpayzon]

previously i had the splunk app for windows installed, but i have deleted it today. could that cause any problems?