Content Pack for Windows Dashboards and Reports

Content Pack for Windows Dashboards and Reports

Entity Discovery Search Reference

Entity discovery search has been included in this version of the Content Pack for Windows Dashboards and Reports to allow automatic discovery of the Active Directory Entities. You can enable entity discovery search as part of the installation steps. For directions on how to do that, see Enable entity discovery search in "Install and configure the Content Pack for Windows Dashboards and Reports."

A reference search is provided in this section. If you need to manually create the entity discovery search, follow the steps to manually import entities.

Manually import entities

Perform the following steps to import your entities for Active Directory Entity Type:

  1. From the main menu, click Configuration > Entities.
  2. Click Create Entity > Import from Search.
  3. Select Ad hoc Search and input the following search:
  4. eventtype=msad_index_windows eventtype="msad-dc-health" | dedup host
    |eval entity_title=host
    |eval entity_type="Active Directory"
    |table entity_title host ForestName Site DomainDNSName DomainNetBIOSName Server entity_type
  5. Run the search and make sure you see your Windows AD data with an entity_type of Active Directory.
  6. Click Next.
  7. Configure the following column rules:
  8. Column name Import column as
    entity_title Entity Title
    host Entity Alias
    Server Entity Alias
    entity_type Entity Type
    ForestName Entity Information Field
    Site Entity Information Field
    DomainDNSName Entity Information Field
    DomainNetBIOSName Entity Information Field
  9. Click Import to import your entities.
  10. After the import job completes, click Set Up Recurring Import and follow the steps in Set up a recurring import of entities in ITSI in the Entity Integrations Manual.
  11. Click View all entities and confirm that your entities are displayed.
Last modified on 23 February, 2023
Reports reference for Content Pack for Windows Dashboards and Reports  

This documentation applies to the following versions of Content Pack for Windows Dashboards and Reports: 1.2.0, 1.2.1, 1.2.2, 1.3.0

Was this topic useful?

You must be logged into in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters