I've installed the universal forwarder on two of my domain controllers without issue. For some reason, on the remaining two, I'm getting the following error on the screen where you specify install directory: "installation directory must be on a local hard drive" This doesn't make any sense as the I've left the default directory on the C: drive. Has anyone seen this before and how do I resolve? I'm using the exact same file/version as on the other 2 DCs (latest build of 6.4)... ... View more

I'm testing splunk and I've followed all the documentation and installed the relevant apps on the DC and splunk instance. I've verified data coming into msad and the other relevant indexes for the App (it passed all tests in guided setup). I've done user and group searches using SA-ldapsearch. If I click All users or All groups dashboards, they return no results. When I run the detect features command for the Windows infrastructure app, I get the following output: Detecting Domains ... Active Directory: Domains found. Detecting Domain Controllers ... Active Directory: Domain Controllers found. Detecting DNS ... Active Directory: DNS not found. Detecting Users ... Active Directory: Users not found. Detecting Computers ... Active Directory: Computers found. Detecting Groups ... Active Directory: Groups not found. Detecting Group Policy ... Active Directory: Group Policy found. Detecting Organizational Units ... Active Directory: Organizational Units found. It's finding computers, GPO, OUs, but not users or groups. (I didn't install DNS app) Anyone have any idea as to what could be going on? I've read a couple of the posts that came up on this forum but haven't gotten the answer I need. Thanks, ... View more