Thank you for this fast answer, i checked all this points :
1) Yes i restarted the service splunk Forwarder after adding TA_DomainControlerNT6
2)A) I have data from perfmon and WinEventLog coming but there from the TA_Windows. If i set them to disabled =1 into the Ta_Windows/input.conf nothing is coming anymore.
Absolutly nothing is coming from TA_DomainControlerNT6 and TA_DnsNT6
2)B) I don't see anything related to netlogon.log
2)C)In my splunkd.conf I see that all the powershell are scheduled for AD and DNS. So I guess that my splunkforwarder detects my addons correctly
12-04-2014 09:28:37.759 +0100 INFO ExecProcessor - New scheduled exec process: "C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-DNSServer-NT6\bin\runpowershell.cmd" dns-health.ps1
12-04-2014 09:28:37.759 +0100 INFO ExecProcessor - interval: 3600000 ms
12-04-2014 09:28:37.759 +0100 INFO ExecProcessor - New scheduled exec process: "C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-DNSServer-NT6\bin\runpowershell.cmd" dns-zoneinfo.ps1
12-04-2014 09:28:37.759 +0100 INFO ExecProcessor - interval: 3600000 ms
12-04-2014 09:28:37.759 +0100 INFO ExecProcessor - New scheduled exec process: "C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-DomainController-NT6\bin\runpowershell.cmd" ad-health.ps1
12-04-2014 09:28:37.759 +0100 INFO ExecProcessor - interval: 300000 ms
12-04-2014 09:28:37.759 +0100 INFO ExecProcessor - New scheduled exec process: "C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-DomainController-NT6\bin\runpowershell.cmd" ad-repl-stat.ps1
12-04-2014 09:28:37.759 +0100 INFO ExecProcessor - interval: 300000 ms
12-04-2014 09:28:37.759 +0100 INFO ExecProcessor - New scheduled exec process: "C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-DomainController-NT6\bin\runpowershell.cmd" siteinfo.ps1
12-04-2014 09:28:37.759 +0100 INFO ExecProcessor - interval: 3600000 ms
I let the thing run for 20 minutes and no error are coming in splunkd.log, so I guess the powershell are running without error.
3) The documentation is stating the only 2.0 version of PS is required. When i'm running the PS1 script myself to check that my version is good, it is running without problem.
I ran the script manualy with psexec -i -s and it is working good.
I discovered something that could be a clue . When i'm cheking "install windows addon" on splunkforwarder, the TA_Windows is automaticaly inside to etc/app and it is working good. But when I don't check it , and install the add-on manualy by coppying it, it is not working.
So it seems that the software is doing something i'm not.. and that is maybe why my manulay installed TA_DomainControler and TA_DNS won't work.
I don't understand what i could be missing. I'm editing the local/input.conf, and coppying the add-on as stated in the doc.
... View more