Dashboards & Visualizations

Quick question about AD app 'GroupType' does not exist [pic]

eafitt
Path Finder

Where is this error coming from? or is this problem within the AD app directory or something with my central splunk server?

http://www.freeimagehosting.net/oinp6

Tags (1)
0 Karma
1 Solution

ahall_splunk
Splunk Employee
Splunk Employee

It's something with your AD app install.

In default/transforms.conf, there is a stanza for GroupType - it basically converts the event type into a field GroupType that contains Security or Distribution. This is backed by a CSV file in lookups/

By default, this happens on your search head and it is passed down to indexers in the replication bundle if you have a separate indexer. However, it should just automatically be there. So, I believe the issue is in your install.

View solution in original post

ahall_splunk
Splunk Employee
Splunk Employee

It's something with your AD app install.

In default/transforms.conf, there is a stanza for GroupType - it basically converts the event type into a field GroupType that contains Security or Distribution. This is backed by a CSV file in lookups/

By default, this happens on your search head and it is passed down to indexers in the replication bundle if you have a separate indexer. However, it should just automatically be there. So, I believe the issue is in your install.

eafitt
Path Finder

It is in the AD app, could it be something with the actual csv file?
http://www.freeimagehosting.net/s86fw

0 Karma

ahall_splunk
Splunk Employee
Splunk Employee

Make sure the GroupType lookup is exported properly (go into Manager->Lookups and export it to system)

0 Karma

eafitt
Path Finder

Actually this error is coming up in every app that I have not just the AD app which I got working.

0 Karma

ahall_splunk
Splunk Employee
Splunk Employee

Read the documentation on http://docs.splunk.com for detailed instructions on how to install the AD app.

0 Karma

eafitt
Path Finder

Ok I'll go back through the install. Also would there happen to be a video or better reference to deploying splunk app for AD? I've been through all the documents on splunk base as well as the readme within the app multiple times and still can't get it to work.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...