I just installed Splunk App for Windows Infrastructure v 1.1.2, and deployed the TA-DomainController-2012R2 on one DC
However, the prequisite test fails, as it finds no events when looking for sourcetype="ActiveDirectory*".
I searched the entire AddOn, and couldn't find any reference to that sourcetype anywhere.
Also, maybe its just metadata, but the App information for this add on is a copy of TA-DomainController-NT6, listing it as the TA for Windows Server 2008. Pherhaps there is a problem with this TA?
... View more