I recently setup a trial Splunk server in my environment, and one of the compents I would like to try is the Splunk App for Active Directory. I also installed the prerequisite apps: Sideview Utils and Windows Technology Add-on.
For data inputs, I have Splunk monitoring the remote event logs on my domain controllers as well as a base DN in Active Directory. I've let it run for almost 24 hours, but there is no data displayed in the Splunk App for Active Directory. Using the built-in Search App, I can find account lockout events, failed logins, etc., but nothing is being displayed in the AD App.
I'm pretty new to Splunk, so I'm sure it's something obvious I've overlooked.
Thanks in advance for any help you can provide.
... View more