HI Giuseppe. Thanks for taking time to reply, I have gone through almost all of the different versions of splunk docs about deploying Splunk add on for Microsoft Active Directory. Each document has little difference. My basic question was what is the difference between deploying Splunk add on for Microsoft Active Directory which is described in the below document. I have single server with splunk enterprise and Microsoft Active Directory installed on separate servers. The idea was to collect Active directory data and security logs from the domain controller. I first tried these 2 documents exactly as it says. I did not get any Active directory related index created such as "msad" "perfmon" etc and nor did I get any security logs pulled form the domain controller where I installed the universal forwarder and deployed the application. Instead I got the active directory data in the main index rather then its own index as per defined in inputs.conf. May be I was suppose to create a folder Local and put inputs.conf in that folder but that is not specified in these 2 procedures. So I tried these... http://docs.splunk.com/Documentation/MSExchange/3.4.1/DeployMSX/DeploytheSplunkAdd-onsforActiveDirectory AND https://docs.splunk.com/Documentation/MSApp/1.4.1/MSInfra/DeploytheSplunkAdd-onsforActiveDirectory Then I saw below procedure http://docs.splunk.com/Documentation/AddOns/latest/Overview/Singleserverinstall which talks about login to splunk app, (Webinterface) go to apps>manage apps> add > and add the app downloaded in the form of splunk-add-on-for-microsoft-active-directory_100.tgz file. Once I did this, suddenly I got index created "msad" "permon" etc and I got the AD data in the msad instead of main. Still I have to create sparate forwarded input and create input for security logs for domain controller. So I dont understand what is the difference between manually expanding add on file to folder, then copy to deployed apps and then restarting splunk and second methond of using Splunk console and adding app using Gui.. I wish there is one consistent method of deploying splunk add on for active directory rather then many different documents. Cheers Sa ... View more

Thanks for your reply: I managed to get around the Forwarder install issue by using this command line install msiexec.exe /i splunkforwarder-6.5.3-36937ad027d4-x64-release.msi /l*v splunkF.log So for AD Auditing, we have appropriate Group policy Auditing turned on and we get that in Security event logs. We like to collect the AD Security logs which will help us to search, Active directory Auditing, who access, deleted, added to group ETC. Forwarding Event logs from a installed Forwarder is one thing but I am not clear how Splunk Add on for Active Directory OR Splunk App for Active Directory play role in Active Directory Auditing. If I could only have one solid support document how to Audit your Active Directory Environment by Splunk that would be great. thanks ... View more