All Apps and Add-ons

Why is no data being indexed after deploying the Splunk Add-on for Microsoft Windows and "send to indexer" apps?

flynnhandley
Explorer

I have deployed the Splunk Add-on for Microsoft Windows and the send to indexer app successfully to my forwarders.

I have a server called activedirectory which I can see has downloaded the apps, however, no data is being indexed. Actually, I can't see data from any of the servers that have the app deployed.

I can see on the splunk server that activedirectory has made a connection on 9997.

if I search for host=activedirectory there are no events

Any ideas where I should start troubleshooting?

Data Summary

Host Count Last Update
SERVER1 135 3/24/15 2:30:30.000 PM
splunk 1 3/24/15 12:45:33.000 PM

C:\Program Files\Splunk\etc\deployment-apps\Splunk_TA_windows\local

OS Logs
[WinEventLog://Application]
disabled = 0
start_from = oldest
current_only = 0
checkpointInterval = 5
index = wineventlog
renderXml=false

[WinEventLog://Security]
disabled = 0
start_from = oldest
current_only = 0
evt_resolve_ad_obj = 1
checkpointInterval = 5
blacklist1 = EventCode="4662" Message="Object Type:\s+(?!groupPolicyContainer)"
blacklist2 = EventCode="566" Message="Object Type:\s+(?!groupPolicyContainer)"
index = wineventlog
renderXml=false

[WinEventLog://System]
disabled = 1
start_from = oldest
current_only = 0
checkpointInterval = 5
index = wineventlog
renderXml=false

C:\Program Files\Splunk\etc\deployment-apps\sendtoindexer\local

[tcpout]
defaultGroup = default-autolb-group

[tcpout:default-autolb-group]
server = splunk:9997

[tcpout-server://splunk:9997]

alemarzu
Motivator

Hi Flynn,

You should read this http://docs.splunk.com/Documentation/MSApp/1.2.0/MSInfra/TroubleshoottheSplunkAppforWindowsInfrastru...

Hope it helps.

0 Karma

uktechnologyser
Path Finder

How did you see the deployment client made a connection on 9997? Did you get a fix for this? I have the same problem.

0 Karma

hcanivel
Explorer

I have a few troubleshooting questions for you:

a) What do your splunkd logs say for both forwarder and indexer? Are there any errors at the forwarder? Maybe the user running Splunk doesn't have winevent log read access?

b) on indexer side, you're writing to index wineventlog. How do you know that it isn't indexing? Have you tried specified the index as part of your query?

c) how do you know that your host is activedirectory and not activedirectory?

Always start with the splunkd logs for any basic errors.

0 Karma

uktechnologyser
Path Finder

a) My splunkd log on the deployment client says:

ERROR TcpOutputProc - LightWeightForwarder/UniversalForwarder not configured. Please configure outputs.conf.

Does this mean it isnt referencing the outputs.conf file in the send to indexer app? This has the configuration telling it to tcp out to the indexers.

b) I know it isnt indexing because i cant see any files populating in the wineventlog folder on the indexers.

c) my host doesnt appear,

Interestingly if i install the Splunk_TA_windows app directly on the indexers it starts getting logs straight away and storing them locally. From there i can search them from the search head. It must be a problem with the send to indexer app.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...