Splunk Search

Eventtype 'msad-dc-health' does not exist or is disabled.

baroudiem
New Member

After deploying windows infrastructure application i got blocked dashbords with this error message " Eventtype 'msad-dc-health' does not exist or is disabled"
knowing that the index = msad is getting logs

0 Karma

oscar84x
Contributor

If you run index=* eventtype=msad-dc-health do you see the data?

It could need further configuration as per the link below:
https://www.splunk.com/en_us/blog/tips-and-tricks/splunk-app-for-active-directory-and-the-top-10-iss...

"The other data input that requires a little bit of configuration is the health scripts. Active Directory stores a lot of the health information in data structures stored in memory rather than in the directory. It requires that we access .NET libraries to retrieve the information. If you are not seeing the domain selector working, then it is likely that you are not receiving this health data. You can further check this by executing the following search:

eventtype=msad-dc-health

If you log on to a domain controller, you can run the health script manually with the following command:

CD C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-DomainController-NT6\bin C:\Program Files\SplunkUniversalForwarder\bin\splunk cmd runpowershell.cmd ad-health.ps1

If Powershell is turned off, the error message will tell you that scripts are disabled on this host. You can repair this situation by turning on Powershell within the same GPO you use to alter the audit settings, or you can create a new GPO for this purpose. As with the audit settings GPO, it needs to be attached to the domain controllers on each domain. As with the audit settings, you can read about this process in our documentation."

0 Karma
Get Updates on the Splunk Community!

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...