Issue description  

Prerequisites  

Before troubleshooting, ensure the following:

• ADAudit Plus is able to establish communication with the Splunk server on the configured HTTP collector port.

• The correct authentication token is provided in the Splunk configuration page.

Possible causes  

• The POST URL configured in ADAudit Plus is not accessible from the ADAudit Plus server.
  
• The authentication token is not configured properly.

• Data being forwarded might not be in the required Splunk format.
  

Resolution  

Step 1: Verify network connectivity  

1. Verify if the POST URL configured in ADAudit Plus is accessible from the ADAudit Plus server.

Step 2: Verify Splunk HTTP event collector configuration  

1. From the Splunk UI, check if the HTTP Event Collector is correctly configured.
   
2. If not, follow these steps:
   

• Click on Settings → Data Inputs → HTTP Event Collector.

• Click New Token and provide a name (preferably "ADAuditPlus"). Leave other settings as default unless customization is required.

• After saving, an authentication token will be generated. This token must be provided in the ADAudit Plus configuration.

• Under Global Settings in the HTTP Event Collector page, enable All tokens.

• You may customize the HTTP port number and SSL settings as required in Global Settings.

Step 3: Verify log forwarding configuration in ADAudit Plus  

1. Ensure the details from Step 2 are correctly configured in ADAudit Plus.
   
2. Navigate to Admin Tab → SIEM Integration.

3. Tick the Enable checkbox and select the Splunk radio button.

4. Enter the Splunk Server name and ensure that it is reachable from the ADAudit Plus Server.

5. Provide the Splunk HTTP Event Collector port number and protocol.

6. Enter the HTTP Event Collector token generated in Splunk for ADAudit Plus.

7. After saving, choose the categories to forward.
   

Step 4: Verify if data is in SPLUNK-Compatible format  

1. Navigate to <product_home>\splunk_temp and sort files by date in descending order.
   
2. Check older files for syntax errors or empty content.

3. If syntax does not match "Splunk" format or files are empty, delete them and restart ADAudit Plus service.

4. Example of correct Splunk syntax:

5. {"time":1624534057,"event":{"DOMAIN":"ADAuditPlus Authentication","Category":"ADAPTechnicianAudit","ACCOUNT_ID":"1","LOGIN_ID":"1","CLIENT_IP_ADDRESS":"127.0.0.1","EVENT_TYPE":"8","USER_ID":"1","ADDITIONAL_INFO":"-","CLIENT_HOST_NAME":"ADAudit Plus Server","ACTION_ID":"4","ACTION_CATEGORY":"Admin","TIME_GENERATED":"1624534057","ACCESS_TYPE":"8","FORMAT_MESSAGE":"Successfully saved SIEM Integration Categories data","SESSION_ID":"20409","LOGIN_NAME":"admin","SEVERITY":"2"}}
   

Related topics and articles  

• SIEM Integration Guide
  
• Splunk Integration Documentation

• General Troubleshooting for Log Forwarding
  

When and how to reach support