I have the Splunk App for windows infrastructure up and running. the support SA-ldapsearch is installed along with java and functioning fine as well. I am receiving results on virtually every dashboard included with the app.
The only dashboard I am having issues with is the Administrator Audit. I keep receiving a 'Search query is not resolved." msg in every view on that dashboard. Under Account Domain/Administrator there is a Search Produced no results message and its looking for the default 'Last 15 minutes'.
If I change the 15 minutes to 24 hours, or 1 minuted or some other 'real-time' search, the Account Domain: will start 'Populating' and finally find the Domain, but the Administrator is being hardset to some random user/computer account and will not let me search/choose from an actual Administrator.
I do not see any specific errors in splunkd.log or my SA-ldapsearch log relating to this. Any ideas?
... View more
