Did you end up getting this to work? I had the same issue and was told I hadn't deployed the TA app to the deployments, so the universal forwarders weren't actually sending the right metrics to the msad index. Check that you have copied the Windows TA and AD monitor apps into the deployment apps folder. Then check the inputs.conf to ensure you have the appropriate monitors enabled. Once you've done that you can confirm you have the right indexes created - e.g. msad, and you should start to see data coming in. Also you may need to restart the universal forwarder to apply the config. cheers, Ben ... View more

Is indexes.conf required for Splunk Addon for Windows v800/Splunk App for Windows Infrastructure v201? Its unclear from the documentation, as Splunk_TA_Windows (v800) documentation says indexes.conf is removed? Do I need an indexes.conf in my \local\ folder for MSAD, Windows, Perfmon, Wineventlog?   cheers 🙂   ... View more

Thank you! ... View more

My question is: how do I get the msad  index to receive data? ... View more