I have setup the TA-DomainController-2012R2 app on all 6 of my Domain Controllers, however only 4 are returning any data when I search index=msad sourcetype="msad:nt6:health"
All 6 return when I search index=msad sourcetype="activedirectory"
What am I missing?
They are all setup as forwarders with the following:
Apps
Splunk_TA_windows, TA-DomainController-2012R2
Server Classes
DomainController, Windows
↧
