Splunk app for active directory is not displaying data

[mbuyukkarakas]

Hello everybody

Since couple of days I'm working on Splunk 5.04. Since yesterday all the tests went good. When I started to evaluate app for Active Directory I cant obtain data and I cant display any flow on the dashboard.

Let me tell you how I installed the app. Please correct my errors.

1- Install the app on splunk server.
2- Enable the receiver on splunk server at port 9997.
3- Install the universal forwarder on my Win 2008 R2 Ent. DC.
3.1 - Use a domain account with high privileges.
3.2 - Select all the input types + follow active directory.

now I can display all the event types are created correctly on my Manager screen. Also, on the search screen I can select some sources e.g. "ActiveDirectory" or "Perfmon:CPU Load" and I can see the data flow.

But when I open the Active Directory app. I dont see nothing.

I checked the link below :
http://docs.splunk.com/Documentation/ActiveDirectory/latest/DeployAD/Deploymentprocess

• I configured my splunk server as it.
• I reinstalled the universal forwarder and this time I didnt checked nothing.
• I copied the TAs to my. Restarted splunk agent.

I still dont see nothng on my Splunk server.

Could you please guide me to solve this ?

Thank you so much.
Mehmet

[mbuyukkarakas]

Last update :

My mistake, AD logging is still not working but I'm confused.
I will try to regenerate the situation.

Regards.

[mbuyukkarakas]

Hello, thank you for your quick response

This is strange but I made my last change 2 hours ago. Since two hours I didnt checked the management console. But now I can see everything in the console.

Really strange for me.

As I wrote in my first note,
- I removed all the inputs checks
- and copied from TAs some files to my DC,
- then I restarted the agent.
- Wait two hours 🙂

Thank you for your co-operation.

PS: When I precise my procedure, I will add to this topic.

[sdaniels]

I would double check the steps in the docs to make sure you haven't missed anything. I see this quite often on the Splunk App for AD. However, this is a pretty good troubleshooting reference to help as well.

http://blogs.splunk.com/2012/10/21/splunk-app-for-active-directory-and-the-top-10-issues/

[mbuyukkarakas]

Hello, thank you for your quick response

This is strange but I made my last change 2 hours ago. Since two hours I didnt checked the management console. But now I can see everything in the console.

Really strange for me.

As I wrote in my first note,
- I removed all the inputs checks
- and copied from TAs some files to my DC,
- then I restarted the agent.
- Wait two hours 🙂

Thank you for your co-operation.

PS: When I precise my procedure, I will add to this topic.