Hi,
Firstly, we noted some areas in the Splunk App for Active Directory docs which might lead to confusion and are addressing those issues. If you wouldn't mind noting any other areas you found confusing, that would be great. We really do appreciate the feedback.
The upshot is, while the Splunk App for AD is a fairly complex application to install and configure, the only configuration file you need to edit in a standard Splunk App for Active Directory setup is ldap.conf, as described here.
The quickest procedure for a "Nothing to Active Directory" setup would be:
1. Prepare your AD for data collection, as described here.
2. Download and place in an accessible location:
full Splunk.
the Windows version of the Splunk universal forwarder.
the Splunk App for Active Directory.
the SA-ldapsearch supporting add-on.
the Splunk Technology Add-on for Windows.
Sideview Utils v1.3.2 or later.
3. Install full Splunk on a server. This server becomes your central Splunk instance.
4. Configure the instance to be a receiving indexer.
5. Install the universal forwarder onto a domain controller. During the installation process, configure the forwarder to send data to the receiving indexer.
6. Unpack the Splunk App for Active Directory installation package. Within it, you'll find the Splunk App for Active Directory TAs (in Splunk_for_ActiveDirectory\appserver\addons ).
7. Move the appropriate TAs to %SPLUNK_HOME%\etc\apps on the domain controller, depending on which version of Windows it runs. You do not need to edit any configuration files.
8. Install the Splunk TA for Windows on the domain controller.
9. On the central Splunk instance, install:
the Splunk App for Active Directory.
the SA-ldapsearch supporting add-on.
the Splunk Technology Add-on for Windows.
Sideview Utils.
10. Edit ldap.conf in %SPLUNK_HOME%\etc\apps\SA-ldapsearch\local .
11. Restart all Splunk instances to ensure the changes take effect.
This should give you a minimal, running Splunk App for Active Directory deployment. Specific steps are covered in detail in "How to deploy the Splunk App for Active Directory". If you have additional domain controllers in your AD environment and want data from them, repeat Steps 5, 7, and 8.
Again, the Splunk App for Active Directory is a complex application to install, and requires an in-depth knowledge of both distributed Splunk and Active Directory. You might want to engage Professional Services for assistance if this procedure doesn't help. That said, we constantly review the documentation and thank you for assisting us in our efforts to improve it.
... View more
