All Apps and Add-ons

Install and Upgrade of Splunk App for Windows Infrastructure 1.0.3 does not show Data for Active Directory (Ad) Views.

sat94541
Communicator

rebuilt my Splunk server (version 6.1.3) and installed the Universal Forwarders with the TA for Windows deployed on all my Domain controllers. I see data coming in from Windows Security Eventlog into the index "WinEventLog".

The Splunk App for Windows Infrastructure (1.0.2) is installed. It does not see the data from that index. Or at least I do not think it does. I tried modifying the winevents.conf file to select the correct indexes but must be doing something wrong.

Also when I do the detect in the setup for the Splunk App for Windows Infrastructure it does not detect anything except Group Policy and Organizational Units.

1 Solution

rbal_splunk
Splunk Employee
Splunk Employee

Found that issue was with lookup “DomainSelector.csv” as it wasn’t populated.
Logged in as use “admin” manually ran lookup search “DomainSelector_Lookup” (domain-selector-search|outputlookup DomainSelector.csv). It populated “DomainSelector_Lookup.csv” and all the App Menus are populated and all the AD Views started to work. After 15 minutes the scheduled lookup search ran and squashed out “ DomainSelector.csv”.

To resolve the issue for “ admin role” added all App indexes (winevents, perfmon, msad) to be searched by default , and re-ran the build lookup tables command and now the drop downs are populated and the ldap search for things like disabled users are working.

View solution in original post

rbal_splunk
Splunk Employee
Splunk Employee

Found that issue was with lookup “DomainSelector.csv” as it wasn’t populated.
Logged in as use “admin” manually ran lookup search “DomainSelector_Lookup” (domain-selector-search|outputlookup DomainSelector.csv). It populated “DomainSelector_Lookup.csv” and all the App Menus are populated and all the AD Views started to work. After 15 minutes the scheduled lookup search ran and squashed out “ DomainSelector.csv”.

To resolve the issue for “ admin role” added all App indexes (winevents, perfmon, msad) to be searched by default , and re-ran the build lookup tables command and now the drop downs are populated and the ldap search for things like disabled users are working.

View solution in original post

jrodman
Splunk Employee
Splunk Employee

Wouldn't it be better to add the specific indexes to the search or appropriate macro?

0 Karma

rbal_splunk
Splunk Employee
Splunk Employee

Bug has been logged to review the issue --MSAPP-3142

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!