users and groups not found by add-on for windows infrastructure

[vistek]

I'm testing splunk and I've followed all the documentation and installed the relevant apps on the DC and splunk instance.

I've verified data coming into msad and the other relevant indexes for the App (it passed all tests in guided setup).
I've done user and group searches using SA-ldapsearch.
If I click All users or All groups dashboards, they return no results.

When I run the detect features command for the Windows infrastructure app, I get the following output:

Detecting Domains ...
Active Directory: Domains found.
Detecting Domain Controllers ...
Active Directory: Domain Controllers found.
Detecting DNS ...
Active Directory: DNS not found.
Detecting Users ...
Active Directory: Users not found.
Detecting Computers ...
Active Directory: Computers found.
Detecting Groups ...
Active Directory: Groups not found.
Detecting Group Policy ...
Active Directory: Group Policy found.
Detecting Organizational Units ...
Active Directory: Organizational Units found.

It's finding computers, GPO, OUs, but not users or groups. (I didn't install DNS app)

Anyone have any idea as to what could be going on? I've read a couple of the posts that came up on this forum but haven't gotten the answer I need.

Thanks,

[skramp]

please check your Base DN, maybe that might be the error. When you are too deep in the path, the problem could look like this.

[glandy]

Hi , I had the same issue. In fact it's a missmatch between Lowercase and Uppercase of the DomainNetBiosName.

To correct this issue , you have to modify the "ad-domains" search macro to force the domainname in Lowercase . ( settings / advance search ) .

Modify the macro like above:

inputlookup DomainSelector|stats count by DomainNetBIOSName|where length(DomainNetBIOSName)>0|eval DomainNetBIOSName=lower(DomainNetBIOSName)|rename DomainNetBIOSName as src_nt_domain