All Apps and Add-ons

Splunk for Active Directory - Search "sourcetype="MSAD*" | head 5" did not return any events in the last 24 hours

MalkaAviv
New Member

Hi,

I followed the guide 4 times, and I keep getting the following error on the 'Guided Setup' wizard and on the dashboard there is no results:
Search "sourcetype="MSAD*" | head 5" did not return any events in the last 24 hours

I've uploaded a picture that cover most of the configuration. am I missing something?alt text

Thanks for the helpers!

alt text

0 Karma

s2_splunk
Splunk Employee
Splunk Employee

It looks like the events are not reaching our indexer. Did you validate that your forwarder successfully connects to your indexer? splunkd.log on the forwarder should show messages like "connected to idx=n.n.n.n" if that's successful.
It may also have other error messages that may indicate why events don't reach your indexer.
I would start looking there.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...