sourcetype="ActiveDirectory*"

[ybahat]

I just installed Splunk App for Windows Infrastructure v 1.1.2, and deployed the TA-DomainController-2012R2 on one DC

However, the prequisite test fails, as it finds no events when looking for sourcetype="ActiveDirectory*".

I searched the entire AddOn, and couldn't find any reference to that sourcetype anywhere.

Also, maybe its just metadata, but the App information for this add on is a copy of TA-DomainController-NT6, listing it as the TA for Windows Server 2008. Pherhaps there is a problem with this TA?

[gyslainlatsa · Accepted solution]

hi ybahat,
following this link:

http://docs.splunk.com/Documentation/MSApp/latest/MSInfra/DeploytheSplunkAdd-onsforActiveDirectory

[ybahat]

thank you, the error was completly unrelated and was caused by a failure of the forwarder to report back to the indexer.

[gyslainlatsa]

good, go and vote