Hi dfigurello, I have same an error. I can detect some data active directory as: Active Directory: Domains found. Detecting Domain Controllers Active Directory: Domain Controllers found. Detecting DNS Active Directory: DNS found. But I can't dectect data from User, Computer, Active Directory. Could you please give me the intruction to detect user,computer, AD? Many thanks. ... View more

This is file inputs config of Splunk_TA_Window. Please check for me about this file? [WinEventLog://Application] disabled = 0 start_from = oldest current_only = 0 checkpointInterval = 5 [WinEventLog://Security] disabled = 0 start_from = oldest current_only = 0 evt_resolve_ad_obj = 1 checkpointInterval = 5 [WinEventLog://System] disabled = 0 start_from = oldest current_only = 0 checkpointInterval = 5 DHCP [monitor://$WINDIR\System32\DHCP] disabled = 0 whitelist = DhcpSrvLog* crcSalt = sourcetype = DhcpSrvLog Windows Update Log [monitor://$WINDIR\WindowsUpdate.log] disabled = 0 sourcetype = WindowsUpdateLog File system change monitor [fschange:$WINDIR\System32\drivers\etc] disabled = 0 hashMaxSize = 1048576 pollPeriod = 30 Scripted Input (See also wmi.conf) [script://.\bin\win_listening_ports.bat] disabled = 0 Run once per hour interval = 3600 sourcetype = Script:ListeningPorts [script://.\bin\win_installed_apps.bat] disabled = 0 Run once per day interval = 86400 sourcetype = Script:InstalledApps [script://.\bin\win_timesync_configuration.bat] disabled = 0 interval = 86400 sourcetype = Script:TimesyncConfiguration [script://.\bin\win_timesync_status.bat] disabled = 0 interval = 7200 sourcetype = Script:TimesyncStatus Splunk 5.0+ Performance Counters CPUTime [perfmon://CPUTime] counters = % Processor Time;% User Time disabled = 0 instances = _Total interval = 10 object = Processor Disk [perfmon://FreeDiskSpace] counters = Free Megabytes;% Free Space disabled = 0 instances = * interval = 10 object = LogicalDisk Memory [perfmon://Memory] counters = % Committed Bytes In Use;Available Bytes;Committed Bytes disabled = 0 interval = 10 object = Memory Network [perfmon://LocalNetwork] counters = Bytes Received/sec;Bytes Sent/sec;Bytes Total/sec;Current Bandwidth disabled = 0 instances = * interval = 10 object = Network Interface Thanks ... View more

Hi ppablo_splunk, My version app is 6.X. I have configured to follow link document for version 6.x http://docs.splunk.com/Documentation/MSApp/1.0.2/MSInfra/HowtodeploytheSplunkAppforWindowsInfrastructure but still not success. The following is log when I tried detect feature after config with the link above: Detecting Event Monitoring Windows: Event Monitoring found. Detecting Performance Monitoring Windows: Performance Monitoring found. Detecting Applications and Updates Windows: Applications and Updates not found. Detecting Network Monitoring Windows: Network Monitoring not found. Detecting Print Monitoring Windows: Print Monitoring not found. Detecting Host Monitoring Windows: Host Monitoring not found. Detecting Domains Active Directory: Domains not found. Detecting Domain Controllers Active Directory: Domain Controllers not found. Detecting DNS Active Directory: DNS not found. Detecting Users Active Directory: Users not found. Detecting Computers Active Directory: Computers not found. Detecting Groups Active Directory: Groups not found. I think the ad-on SA-ldapsearch not operate. I have configured ad-on SA-ldapsearch follow to link http://docs.splunk.com/Documentation/ActiveDirectory/latest/DeployAD/ConfiguretheSA-ldapsearchsupportingaddon. Please help me solve problem. Thanks for your support. ... View more

Hi Lowell, I have the same problem as Anthony Hou. My result of alert is fortmat zip. I want change from zip to CSV. Could you please guide me? Thanks a lot. ... View more

Thanks for your supports. I have found results of my search follow your guide.! ... View more

Can you help me !!! ... View more