All Apps and Add-ons

Windows TA- Why are we not seeing any data in Splunk?

edwardrose
Contributor

Hello All,

 

I am trying to ingest some Azure data from our DCs.  I have the following two stanzas added to our Splunk_TA_windows inputs.conf and we still do not see any data and do not see any errors from any of the hosts that have the Azure data.

 

[WinEventlog://Microsoft-AzureADPasswordProtection-DCAgent/Admin]
index = wineventlog
disabled = 0
renderXml=true

[WinEventlog://Microsoft-AzureADPasswordProtection-DCAgent/Operational]
index = wineventlog
disabled = 0
renderXml=true

 

 

Not sure why we are not seeing any data in Splunk.  The AD admin says he sees logs on the host but not in Splunk.  So to me it seems that Splunk is not ingesting the data and I am lost as to why.

 

Thanks

Labels (2)
Tags (3)
0 Karma

asha_muniraju
Loves-to-Learn Lots

Hi,

did anyone fix this issue?

Thanks

0 Karma

Roy_9
Motivator

Have you checked the firewall rules and a connectivity test?

Did you find anything in your internal logs?

0 Karma

jbanAtSplunk
Communicator

Hey, did you find out solution?
I have same issue here?

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...