All Apps and Add-ons

Install and Upgrade of Splunk App for Windows Infrastructure 1.0.3 does not show Data for Active Directory (Ad) Views.

sat94541
Communicator

rebuilt my Splunk server (version 6.1.3) and installed the Universal Forwarders with the TA for Windows deployed on all my Domain controllers. I see data coming in from Windows Security Eventlog into the index "WinEventLog".

The Splunk App for Windows Infrastructure (1.0.2) is installed. It does not see the data from that index. Or at least I do not think it does. I tried modifying the winevents.conf file to select the correct indexes but must be doing something wrong.

Also when I do the detect in the setup for the Splunk App for Windows Infrastructure it does not detect anything except Group Policy and Organizational Units.

1 Solution

rbal_splunk
Splunk Employee
Splunk Employee

Found that issue was with lookup “DomainSelector.csv” as it wasn’t populated.
Logged in as use “admin” manually ran lookup search “DomainSelector_Lookup” (domain-selector-search|outputlookup DomainSelector.csv). It populated “DomainSelector_Lookup.csv” and all the App Menus are populated and all the AD Views started to work. After 15 minutes the scheduled lookup search ran and squashed out “ DomainSelector.csv”.

To resolve the issue for “ admin role” added all App indexes (winevents, perfmon, msad) to be searched by default , and re-ran the build lookup tables command and now the drop downs are populated and the ldap search for things like disabled users are working.

View solution in original post

rbal_splunk
Splunk Employee
Splunk Employee

Found that issue was with lookup “DomainSelector.csv” as it wasn’t populated.
Logged in as use “admin” manually ran lookup search “DomainSelector_Lookup” (domain-selector-search|outputlookup DomainSelector.csv). It populated “DomainSelector_Lookup.csv” and all the App Menus are populated and all the AD Views started to work. After 15 minutes the scheduled lookup search ran and squashed out “ DomainSelector.csv”.

To resolve the issue for “ admin role” added all App indexes (winevents, perfmon, msad) to be searched by default , and re-ran the build lookup tables command and now the drop downs are populated and the ldap search for things like disabled users are working.

jrodman
Splunk Employee
Splunk Employee

Wouldn't it be better to add the specific indexes to the search or appropriate macro?

0 Karma

rbal_splunk
Splunk Employee
Splunk Employee

Bug has been logged to review the issue --MSAPP-3142

0 Karma
Get Updates on the Splunk Community!

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...