Splunk for Active Directory - Search "sourcetype="MSAD*" | head 5" did not return any events in the last 24 hours

[MalkaAviv]

Hi,

I followed the guide 4 times, and I keep getting the following error on the 'Guided Setup' wizard and on the dashboard there is no results:
Search "sourcetype="MSAD*" | head 5" did not return any events in the last 24 hours

I've uploaded a picture that cover most of the configuration. am I missing something?

Thanks for the helpers!

alt text

[s2_splunk]

It looks like the events are not reaching our indexer. Did you validate that your forwarder successfully connects to your indexer? splunkd.log on the forwarder should show messages like "connected to idx=n.n.n.n" if that's successful.
It may also have other error messages that may indicate why events don't reach your indexer.
I would start looking there.