Can one of you post a screenshot of what you're seeing? We have had no reports of this phenomenon so it would be interesting to see exactly what you see. This is on the data check page, correct? ... View more

Not sure why that is happening, but you might want to try: Clearing your cache. Shift-reloading the prerequisites page on the browser. Restarting or resetting your browser. If that doesn't work, delete the app from your Splunk apps directory and then performing the reinstall again. ... View more

The Windows Infrastructure app defines an "Unused user account" as an account whose logon count is 0, meaning that they have never logged on. The search against the domain happens when you load the page and select the desired domain (which should be present if you've configured the app correctly.) ... View more

Hi, There are some bugs open on this very issue and they will be addressed in an upcoming release. Unfortunately I can't say more other than these concerns have been noted. ... View more

There is also the documentation to view. The Splunk App for Microsoft Exchange states in the system requirements that an additional license must be purchased. Neither the Splunk Apps for Windows Infrastructure nor NetApp Data ONTAP require an additional license. ... View more

I have added this verbiage to the docs: Do not use Internet Explorer in compatibility mode when accessing Splunk Web. If you do, Splunk Web warns you that your browser is not supported. If you must use IE in compatibility mode, then use another supported browser for Splunk Web. ... View more

What version of Splunk Enterprise are you running? There was a bug that caused pages not to display after an upgrade to Splunk 6.2 but this was fixed in version 1.1.1. Can you confirm that you are running the latest version of Splunk and the Splunk App for Windows Infrastructure? Thanks. ... View more

Yes, you should be able to remove the DC once you get the required events to pass the data check. ... View more

Hi, You are encountering a bug in this latest version which will be addressed in a future maintenance release. For now, the quickest way to resolve the issue is to set up a domain controller, install a universal forwarder, deploy the TA add-on and collect a few events so that the check passes. Then, turn off the universal forwarder and proceed with using the app as normal. We apologize for any inconvenience caused. ... View more

Only on the DCs. If your 2008 DC is not forwarding events make sure: that you have a forwarder installed on it. That the forwarder has the TA-DomainController-NT6 installed in it. That the forwarder has been configured to send data to indexers. That there is a clean IP connection available from DC to indexer (no firewalls blocking ports) That you have changed AD audit policy to log the Additional AD events that the app needs. That the indexer has the appropriate indexes configured on it. That the user account on the SH has been configured to search those indexes. A quick search with"index=msad host=Hostname-of-DC" is a great start. If you're not seeing data, walk back through this list. It's usually network connectivity or misconfiguration (and sometimes both.) ... View more

Settings > Roles > "Winfra-admin" role ... View more

See my response above. If you run 2012R2 you need to also deploy the SA-ModularInput-Powershell as well as TA-DomainController-2012R2. ... View more

If you run Windows Server 2012R2, then you need to deploy the TA-DomainController2012R2 and the SA-ModularInput-Powershell add-ons to those DCs. ... View more

You cannot run the Splunk App for Windows Infrastructure on Splunk Free. It must run on Splunk Enterprise. http://docs.splunk.com/Documentation/MSApp/latest/MSInfra/Platformandhardwarerequirements#What_versions_of_Splunk_Enterprise_does_the_app_support.3F ... View more

Ah! Right. Yes, unfortunately that is a bug, and we'll be addressing it in a point release. In the meantime, to get through setup, go ahead and deploy the Active Directory TA onto your SH to generate some dummy data. Once you have enough to get through setup (you only need about 5-10 events or so, turn it off. Apologies for the inconvenience. ... View more

The Splunk Supporting Add-on for Active Directory doesn't actually collect AD events. It performs LDAP queries against your AD DCs and returns events based on those queries. Those events have no source type. But it seems like you might have enabled the Active Directory input when you installed the universal forwarder. This is because "ActiveDirectory" is the default source type that gets assigned to default admon inputs. It's important not to enable any inputs when you install the UF because the TAs that come with the Windows Infrastructure app will take care of collecting all that information with the right source type. At this point it's best to just delete that data and then install the correct Active Directory add-on for your version of Windows Server into the universal forwarder that is on the domain controller. That way the data will be indexed correctly, and the app will see it. ... View more

Right, it's the data check that is failing. Events with source type MSAD go into the 'msad' index by default. Make sure that the 'winfra-admin' role searches the 'msad', 'perfmon', and 'winevents' roles by default. In the Splunk system bar, select "Settings" > "Access controls." From there , click "Roles", then click "winfra-admin." Once you get to that page, scroll down to "Indexes searched by default." The three indexes I mentioned above should be in the "Selected Indexes" pane. ... View more

I've seen this problem occur in test environments. Are you running this in a nix environment? If so, this is likely a permissions issue, and if it is what I think it is, we might need to file a bug. It *might have been fixed in 6.2.1, so give that a try first. Here's what's going on: KV store is enabled by default. The problem is, one of the files in the distribution has permissions that are too lax. When the KV store service starts up, it finds that this file has bad permissions, and then only fails with an error message to $SPLUNK_HOME/var/log/splunk/mongod.log: 2014-12-18T15:39:43.555Z permissions on /opt/splunk-dash/var/lib/splunk/kvstore/mongo/splunk.key are too open In order to fix the problem and ensure that KV store is running, you need to change the permissions of this file so that the KV store service doesn't complain and not start. To fix this: From a shell (or Terminal window), issue chmod 700 /opt/splunk/var/lib/splunk/kvstore/mongo/splunk.key Restart Splunk and run the guided setup on the Exchange app again. ... View more

The documentation has a topic on how to add the license. ... View more

What exactly are you searching for on the search head? Can we see the splunkd.log on the indexer? ... View more

Forwarder set up to send data to the receiving indexer on the correct port? Indexer set up to receive data from forwarders on the same port? Is connectivity good between all server(s) Have firewalls either been turned off or configured to allow port(s) specified above? TA installed in Splunk_TA_Nix on universal forwarder? SA-Nix installed on server (search head) that runs the app (and on indexers when forwarding data from search head)? Usually when you don't see data, it's network, permissions, or a combination of both. Any logs would be beneficial, particularly on the forwarders. ... View more

Hi, The Windows Infrastructure first-time-run page detects on event types. Even if the data is present, the detection will fail if the event types are not present. Can you perform the following search and see what data comes back? eventtype=msad-dc-health ... View more