Splunk® App for Windows Infrastructure

Deploy and Use the Splunk App for Windows Infrastructure

Download manual as PDF

This documentation does not apply to the most recent version of MSApp. Click here for the latest version.
Download topic as PDF

Download and configure the Splunk Add-ons for Active Directory

This topic discusses how to download and configure the Splunk Add-ons for Active Directory and deploy them to your deployment clients so that they forward Active Directory to the Splunk App for Windows Infrastructure indexer.

The Splunk App for Windows Infrastructure download package comes with a suite of add-ons that collect Active Directory data (as well as other data types, that this manual will explain later.) When you deploy the add-ons to your deployment clients, the clients collect Active Directory data and forward it to the central Splunk App for Windows Infrastructure indexers.

More information about the Active Directory add-ons

The following table lists the Active Directory add-ons that come with the Splunk App for Windows Infrastructure, and what each add-on provides.

Add-on Description
TA-DomainController-NT5 For Active Directory domain controllers that run Windows Server 2003/2003 R2 and earlier
TA-DomainController-NT6 For Active Directory domain controllers that run Windows Server 2008/2008 R2 and later
TA-DomainController-2012r2 For Active Directory domain controllers that run Windows Server 2012 R2 and later. Requires the Splunk Add-on for PowerShell.

The add-ons reside in the \appserver\addons directory in the app installation package.

Download the Splunk Add-ons for Active Directory

The Splunk Add-ons for Active Directory come with the Splunk App for Windows Infrastructure installation package. You can download the Splunk App for Windows Infrastructure from Splunk Apps.

Download the app and save it to an accessible place on the deployment server:

1. In a web browser, proceed to the Splunk App for Windows Infrastructure download page.

2. Click the download link to begin the download process.

  • Make sure you download the latest version of the app.
  • You might need to sign in with your Splunk account before the download starts.

3. When prompted, choose an accessible location on your deployment server to save the download. Do not attempt to run the download.

4. Use an archive utility such as WinZip to unarchive the file to an accessible location.

Configure the Splunk Add-ons for Active Directory

The Splunk Add-ons for Active Directory do not require any configuration edits by default. When you deploy them onto the Active Directory domain controllers, they immediately begin collecting data as long as you have configured audit policy.

What's next?

You have downloaded the Splunk App for Windows Infrastructure and located the Splunk Add-ons for Active Directory. The next step involves deploying those add-ons into the deployment clients that you install on your Active Directory domain controllers.

PREVIOUS
Configure PowerShell Execution policy in Active Directory
  NEXT
Deploy the Splunk Add-ons for Active Directory

This documentation applies to the following versions of Splunk® App for Windows Infrastructure: 1.1.0, 1.1.1, 1.1.2, 1.1.3, 1.2.0, 1.2.1


Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters