All Apps and Add-ons

Install and Upgrade of Splunk App for Windows Infrastructure 1.0.3 does not show Data for Active Directory (Ad) Views.

sat94541
Communicator

rebuilt my Splunk server (version 6.1.3) and installed the Universal Forwarders with the TA for Windows deployed on all my Domain controllers. I see data coming in from Windows Security Eventlog into the index "WinEventLog".

The Splunk App for Windows Infrastructure (1.0.2) is installed. It does not see the data from that index. Or at least I do not think it does. I tried modifying the winevents.conf file to select the correct indexes but must be doing something wrong.

Also when I do the detect in the setup for the Splunk App for Windows Infrastructure it does not detect anything except Group Policy and Organizational Units.

1 Solution

rbal_splunk
Splunk Employee
Splunk Employee

Found that issue was with lookup “DomainSelector.csv” as it wasn’t populated.
Logged in as use “admin” manually ran lookup search “DomainSelector_Lookup” (domain-selector-search|outputlookup DomainSelector.csv). It populated “DomainSelector_Lookup.csv” and all the App Menus are populated and all the AD Views started to work. After 15 minutes the scheduled lookup search ran and squashed out “ DomainSelector.csv”.

To resolve the issue for “ admin role” added all App indexes (winevents, perfmon, msad) to be searched by default , and re-ran the build lookup tables command and now the drop downs are populated and the ldap search for things like disabled users are working.

View solution in original post

rbal_splunk
Splunk Employee
Splunk Employee

Found that issue was with lookup “DomainSelector.csv” as it wasn’t populated.
Logged in as use “admin” manually ran lookup search “DomainSelector_Lookup” (domain-selector-search|outputlookup DomainSelector.csv). It populated “DomainSelector_Lookup.csv” and all the App Menus are populated and all the AD Views started to work. After 15 minutes the scheduled lookup search ran and squashed out “ DomainSelector.csv”.

To resolve the issue for “ admin role” added all App indexes (winevents, perfmon, msad) to be searched by default , and re-ran the build lookup tables command and now the drop downs are populated and the ldap search for things like disabled users are working.

jrodman
Splunk Employee
Splunk Employee

Wouldn't it be better to add the specific indexes to the search or appropriate macro?

0 Karma

rbal_splunk
Splunk Employee
Splunk Employee

Bug has been logged to review the issue --MSAPP-3142

0 Karma
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...