All Apps and Add-ons

"sourcetype="MSAD*" | head 5" did not return any events in the last 24 hours

tannerd
New Member

I'm trying to get through the guided set up for the Windows Infrastructure App but when running through the data checks for Active Directory, i get Search "sourcetype="MSAD*" | head 5" did not return any events in the last 24 hours. I have active directory data being pulled, and my msad index has data in it..

What am I missing?? I have NO sourcetypes of "MSAD", but have tons of "Active Directory" source types.

Nothing in the forums has seemed to answer my question. I appreciate any assistance. Thank you

0 Karma
1 Solution

paulgreenspan
Engager

You should check the splunkd.log on your AD machine to see if there are ERRORs.

Make sure that you have deployed the PowerShell (SA-ModularInput-PowerShell) and the other
prereqs that are listed in here.

Here are the etc/apps that I have deployed on my forwarder:

drwx------+ 1 SYSTEM SYSTEM 0 Jun 30 09:36 introspection_generator_addon
drwx------+ 1 SYSTEM SYSTEM 0 Jun 30 09:36 search
drwx------+ 1 SYSTEM SYSTEM 0 Jun 30 09:37 SplunkUniversalForwarder
drwx------+ 1 SYSTEM SYSTEM 0 Jun 30 09:37 learned
drwx------+ 1 Administrator None 0 Jun 30 09:50 TA-DomainController-2012R2
drwx------+ 1 Administrator None 0 Jun 30 09:50 SA-ldapsearch
drwx------+ 1 Administrator None 0 Jun 30 09:50 splunk_app_windows_infrastructure
drwx------+ 1 Administrator None 0 Jun 30 09:50 SA-ModularInput-PowerShell
drwx------+ 1 Administrator None 0 Jun 30 10:12 Splunk_TA_windows

Also, make sure that the inputs.conf files do not have "disabled = 1" for the collections that you care about.

View solution in original post

butterslol
Engager

Hi,

You should make sure that your user actually is set to search these indexes by default. I found that once I went to Settings->Access Controls->Roles-> (pick a role your account has) ->Indexes searched by default, and selected 'msad', 'perfmon', 'windows' and 'wineventlog' in addition to what was already there.

Then when the setup wizard was running the search it found all the sourcetypes.

nwieseler
Path Finder

This was exactly my issue. Thank you for the idea all these years later.

Search "sourcetype="Perfmon*" | head 5" did not return any events in the last 24 hours
Search "sourcetype="WinHostMon*" | head 5" did not return any events in the last 24 hours
Search "sourcetype="MSAD*" | head 5" did not return any events in the last 24 hours
Search "sourcetype="ActiveDirectory*" | head 5" did not return any events in the last 24 hours

and so on...

0 Karma

paulgreenspan
Engager

You should check the splunkd.log on your AD machine to see if there are ERRORs.

Make sure that you have deployed the PowerShell (SA-ModularInput-PowerShell) and the other
prereqs that are listed in here.

Here are the etc/apps that I have deployed on my forwarder:

drwx------+ 1 SYSTEM SYSTEM 0 Jun 30 09:36 introspection_generator_addon
drwx------+ 1 SYSTEM SYSTEM 0 Jun 30 09:36 search
drwx------+ 1 SYSTEM SYSTEM 0 Jun 30 09:37 SplunkUniversalForwarder
drwx------+ 1 SYSTEM SYSTEM 0 Jun 30 09:37 learned
drwx------+ 1 Administrator None 0 Jun 30 09:50 TA-DomainController-2012R2
drwx------+ 1 Administrator None 0 Jun 30 09:50 SA-ldapsearch
drwx------+ 1 Administrator None 0 Jun 30 09:50 splunk_app_windows_infrastructure
drwx------+ 1 Administrator None 0 Jun 30 09:50 SA-ModularInput-PowerShell
drwx------+ 1 Administrator None 0 Jun 30 10:12 Splunk_TA_windows

Also, make sure that the inputs.conf files do not have "disabled = 1" for the collections that you care about.

demodav
Path Finder

Is active directory only for universal forwarders, could it be used for intermediate forwarders?

0 Karma
Get Updates on the Splunk Community!

Exporting Splunk Apps

Join us on Monday, October 21 at 11 am PT | 2 pm ET!With the app export functionality, app developers and ...

Cisco Use Cases, ITSI Best Practices, and More New Articles from Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Build Your First SPL2 App!

Watch the recording now!.Do you want to SPL™, too? SPL2, Splunk's next-generation data search and preparation ...