About omatsei

omatsei · ‎05-08-2013

The newest one, 5.0.2.

omatsei · ‎05-08-2013

I'm trying to get all the Active Directory stuff working, and almost everything is (thanks to the nice folks on here). The only part that isn't working so far is the DNS performance monitoring. For whatever reason, the eventtype "perfmon-dns" is empty. All the DNS servers are also domain controllers, so I installed the Splunk TA for Winows, and the TA for DNS Servers and Domain Controllers on each domain controller, and everything else seems to work. I can check the status of the DNS servers and all the zones have information, but the DNS perfmon is still empty. Anyone know what I can check?

omatsei · ‎05-08-2013

I followed all these instructions, and everything appears to work perfectly! Thank you!

omatsei · ‎05-08-2013

This is much better than anything else I've found on the subject thus far. For step 8, does that entail simply extracting the folder called "Splunk_TA_windows" into the %SPLUNK_HOME%\etc\apps folder, similar to step 7?

omatsei · ‎05-07-2013

I've been fighting with the Active Directory app for 4 days now, and I'm becoming frustrated. I had it working, except for some really strange hostname issues, which I was unable to resolve. At this point, I have uninstalled every universal forwarder, and the central Splunk install completely. I have deleted every single reference of Splunk from every file or directory that I can find. Is there any documentation for how to install Splunk from scratch, then install the Active Directory app and have all the features work? The existing documentation is vague and unhelpful in some rather important spots. For example, when editing the conf files, it says I should ensure the correct indexes are set. What are the correct indexes? If I'm installing directly out of the box, do I need to change ANY conf file at all? Isn't there a "from nothing to monitor AD" guide somewhere out there?

omatsei · ‎05-07-2013

Maybe I'm not explaining it right. The data is coming in tagged as "domaincontroller.domain", but I want it to be tagged as "domaincontroller". All the other data from the same domain controller, using the universal forwarder, is tagged as "domaincontroller". Why are the fields for the security stuff tagged differently?

omatsei · ‎05-07-2013

I don't understand. I installed the Universal Forwarder on 5 domain controllers, as it required for the active directory app. Considering everything I've done is a completely out-of-the-box install, how can it not work?

omatsei · ‎05-07-2013

No, if I select "Security" then "User Utilization", it says "No matching fields exist", and no results under any of the boxes.

omatsei · ‎05-07-2013

I just added hat. Is there any way to test that app?

omatsei · ‎05-07-2013

I've got the Active Directory app installed, and everything is working except the User Logon Failures tab. The search is: search eventtype=msad-failed-user-logons (host="HOSTNAME") | fields _time,signature,src_ip,src_host,src_nt_domain,user,Logon_Type However, the data is coming in tagged with the host as "HOSTNAME.domain". If I modify the search manually to say: search eventtype=msad-failed-user-logons (host="HOSTNAME.domain") | fields _time,signature,src_ip,src_host,src_nt_domain,user,Logon_Type Everything works. Is there a conf file I need to change somewhere?

Posts	10
Solutions	0
Karma Given	1
Karma Received	1
Member Since	‎05-31-2011

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

DNS Perfmon

From Nothing to Active Directory

Active Directory User Logon Failures

Re: DNS Perfmon

DNS Perfmon

Re: From Nothing to Active Directory

Re: From Nothing to Active Directory

From Nothing to Active Directory

Re: Active Directory User Logon Failures

Re: Active Directory User Logon Failures

Re: Active Directory User Logon Failures

Re: Active Directory User Logon Failures

Active Directory User Logon Failures

Join the Conversation