That's because we don't execute an "SQL query" - with AD, no SQL is involved. ... View more

This has nothing to do with Active Directory. If you want to grab the appropriate events for Active Directory, I suggest starting with the Splunk App for Active Directory. The App is available for download from splunkbase, and is documented at http://docs.splunk.com ... View more

No. You need to install the Universal Forwarder on your Domain Controllers, configuring it to send events to your central splunk instance, and then install the Splunk_TA_windows and the appropriate Technology Add-ons in appserver/addons of the Splunk for Active Directory app. Remote data collection is NOT supported with the Splunk for Active Directory app. ... View more

It's probably because you did not re-generate the lookups required by the app, so you will have to wait for them to generate themselves, or run them manually. ... View more

You can easily nest things by using the other LDAP commands in the package. For example, using |ldapsearch domain="X" search="(CN=#*)" attrs="distinguishedName"|ldapgroup You get an expansion that actually shows the membership in a field called memberDN. You can expand this with ldapfetch: |ldapsearch domain="X" search="(CN=#*)" attrs="distinguishedName"|ldapgroup|mvexpand memberdn|table cn,memberdn|ldapfetch dn=memberdn attrs="mail"|table cn,memberdn,mail Check out the specific documentation within the SA-ldapsearch app, that has explicit examples for each of the four commands. ... View more

The field names are not the same as you type - they are the "official" names - remember that field names are case sensitive. For example, dn is actually called "distinguishedName" - dn is just an alias. ... View more

No, you would not. The Splunk App for Exchange requires a good set of data to determine the function of each machine. Is there a reason you cannot install the Splunk UF on the Exchange host? ... View more

It is not possible for the Splunk for Microsoft Exchange to be fully functional and not install anything on the Exchange server. Too many things are embedded in the Exchange Powershell and/or .NET structures that we read as part of this. However, you can still use PARTS of the app to handle your logs. For instance, let's say you put your message tracking logs on a file share instead. You can import them with the sourcetype MSExchange:2010:MessageTracking (or replace the 2010 with 2007 or 2013, depending on your version), then they will be recognized by the props/transforms that are in the Splunk for Microsoft Exchange. In this case, you will need the sections of the props/transforms from the app that deal with the message tracking logs, plus a file input that reads the files and sets the sourcetype. ... View more

Not really. I am working on new CSS for the app, which will fix it in the next release. Until then, you can adjust the application.css (in appserver/static) yourself. ... View more

What version of Splunk are you using? I'm also having an issue with v5.0.1 Simple XML - it doesn't like spaces at the beginning of the pipeline, so you may want to try removing that space at the start of your searchTemplate block. ... View more

You are using it in the right way, so something else must be going on. On my 5.0.1 system, this results in the fields appearing in the side-bar. We also use table, etc. several times in the Splunk App for Active Directory, so that would break if this didn't work. ... View more

This would indicate that you are not receiving the log data necessary. You have not provided any details of how you installed the app, so I can't diagnose any further than that. Please check out the documentation at http://docs.splunk.com and ensure you followed all the installation steps. ... View more

If you don't have SMTP configured, you won't see inbound or outbound messages - they are delivered via SMTP. ... View more

Given the problem, you want to use a Splunk Universal Forwarder to read the WinEventLog:Security. The Splunk App for Active Directory provides all the field extractions necessary to do what you need to do. ... View more

As another idea, look in your macros.conf and ensure that the domain-selector macro starts with inputlookup - if it starts with eventtype= then thats your issue. The file will be in Splunk_for_ActiveDirectory/local/macros.conf ... View more

The Splunk App for Active Directory is not a straight forward "install it on the search head and you are good" app - the Technology Addons, SA-ldapsearch, macros, lookups and event types all coordinate to provide the information. There are a bunch of things that can be going wrong here, and they are probably all driven by the fact that there is an upgrade process. Bring up the Search page in the Splunk App for Active Directory and execute the following search: eventtype=msad-dc-health Make sure that is bringing back data. If it is, then the rest of the app should work, since you are getting the right things happening. If it isn't, then you are likely going to get the same error as before. Make sure the eventtypes.conf is properly installed and that there is not local copies of the eventtypes.conf. ... View more

This is precisely the information that is provided by the Splunk App for Active Directory. Check on http://docs.splunk.com for information on this app. ... View more

I need some more information to diagnose this. What version of Splunk App for Active Directory are you running? What page (URL) is this occurring on? Is there a panel on that page that is misbehaving? If so, which one? Have you followed the instructions on http://docs.splunk.com in configuring the app? Once I have that information, we can assist. ... View more

If you are evaluating Splunk, then please contact your friendly Splunk sales rep for assistance. ... View more