I just installed Splunk App for Windows Infrastructure v 1.1.2, and deployed the TA-DomainController-2012R2 on one DC
However, the prequisite test fails, as it finds no events when looking for sourcetype="ActiveDirectory*".
I searched the entire AddOn, and couldn't find any reference to that sourcetype anywhere.
Also, maybe its just metadata, but the App information for this add on is a copy of TA-DomainController-NT6, listing it as the TA for Windows Server 2008. Pherhaps there is a problem with this TA?
hi ybahat,
following this link:
http://docs.splunk.com/Documentation/MSApp/latest/MSInfra/DeploytheSplunkAdd-onsforActiveDirectory
hi ybahat,
following this link:
http://docs.splunk.com/Documentation/MSApp/latest/MSInfra/DeploytheSplunkAdd-onsforActiveDirectory
thank you, the error was completly unrelated and was caused by a failure of the forwarder to report back to the indexer.
good, go and vote