Deployment Architecture

Splunk add-on for windows infrastructure

mysplunkbase
Explorer

I am not receiving data in my windows infrastructure search head

msad is enabled but not reading any data

0 Karma

benloveday
New Member

Did you end up getting this to work?

I had the same issue and was told I hadn't deployed the TA app to the deployments, so the universal forwarders weren't actually sending the right metrics to the msad index.

Check that you have copied the Windows TA and AD monitor apps into the deployment apps folder. Then check the inputs.conf to ensure you have the appropriate monitors enabled.

Once you've done that you can confirm you have the right indexes created - e.g. msad, and you should start to see data coming in.

Also you may need to restart the universal forwarder to apply the config.

cheers,

Ben

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!