Deployment Architecture

Splunk add-on for windows infrastructure


I am not receiving data in my windows infrastructure search head

msad is enabled but not reading any data

0 Karma

New Member

Did you end up getting this to work?

I had the same issue and was told I hadn't deployed the TA app to the deployments, so the universal forwarders weren't actually sending the right metrics to the msad index.

Check that you have copied the Windows TA and AD monitor apps into the deployment apps folder. Then check the inputs.conf to ensure you have the appropriate monitors enabled.

Once you've done that you can confirm you have the right indexes created - e.g. msad, and you should start to see data coming in.

Also you may need to restart the universal forwarder to apply the config.



0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!