Review the following prerequisites before installing the content pack:

• Enable the App Key-Value Store in your environment where the content pack is installed.
• Install and configure the IT Service Intelligence (ITSI) or IT Essentials Work App in your environment. See About Splunk ITSI in the Install and Upgrade Manual, or Install IT Essentials Work in the Overview of Splunk IT Essentials Work manual.

The content pack relies on data from the Splunk Add-on for Microsoft Windows. The add-on collects the computer, groups, security, DNS, organizational, and domain data from your Windows server hosts.

To learn how to install and configure the add-on, see Install the Splunk Add-on for Microsoft Windows in the Splunk Add-on for Microsoft Windows manual.

For information about getting data in from the Splunk Add-on for Microsoft Windows for the content pack, see Get Windows server data.

The following table shows where to install the Splunk Add-on for Microsoft Windows in your distributed environment:

The content pack relies on the custom commands provided by the Splunk Supporting Add-on for Active Directory for searching attributes from the Active Directory.

To learn how to install and configure the add-on, see Install the Splunk Supporting Add-on for Active Directory in the Splunk Supporting Add-on for Active Directory manual.

For information about getting data in from the Splunk Supporting Add-on for Active Directory for the content pack, see Get Active Directory data.

The following table shows where to install the Splunk Supporting Add-on for Active Directory in your distributed environment:

To install the Content Pack for Windows Dashboards and Reports, you must install the Splunk App for Content Packs. To install the Splunk App for Content Packs in your environment, see the Install the Splunk App for Content Packs.

After you have installed the Splunk App for Content Packs, perform the following steps to install the content pack:

1. From the ITSI main menu, click Configuration > Data Integrations.
2. Select Content Library.
3. Select the Windows Dashboards and Reports content pack.
4. Review what's included in the content pack and then click Proceed.
5. Configure the following settings:
[/topic/topic/body/section/ol/ol {""}) [/topic/topic/body/section/ol/ol/li {""}) [/topic/topic/body/section/ol/ol/li/b {""}) Choose which objects to install (b]: For a first-time installation, select the items you want to install and deselect any you're not interested in. For an upgrade, the installer identifies which objects from the content pack are new and which ones already exist in your environment from a previous installation. You can selectively choose which objects to install from the new version or install them all. (li] [/topic/topic/body/section/ol/ol/li {""}) [/topic/topic/body/section/ol/ol/li/b {""}) Choose a conflict resolution rule for the objects you install (b]: For upgrades or subsequent installs, decide what happens to duplicate objects introduced from the content pack. Choose from the following options: (li] [/topic/topic/body/section/ol/ol/ol {""}) [/topic/topic/body/section/ol/ol/ol/li {""}) [/topic/topic/body/section/ol/ol/ol/li/b {""}) Install as new (b]: Objects are installed and any existing identical objects in your environment remain intact. (li] [/topic/topic/body/section/ol/ol/ol/li {""}) [/topic/topic/body/section/ol/ol/ol/li/b {""}) Replace existing (b]: Existing identical objects are replaced with those from the new installation. Any changes you previously made to these objects are overwritten. (li] (ol] [/topic/topic/body/section/ol/ol/li {""}) [/topic/topic/body/section/ol/ol/li/b {""}) Import as enabled (b]: Select whether to install objects as enabled or to leave them in their original state. We recommend that you import objects as disabled to ensure your environment doesn't break from the addition of new content. This setting only applies to services, correlation searches, and aggregation policies. All other objects such as KPI base searches and saved searches are installed in their original state regardless of the option you choose. (li] [/topic/topic/body/section/ol/ol/li {""}) [/topic/topic/body/section/ol/ol/li/b {""}) Modify status of saved searches (b]: This option will be displayed solely if the content pack contains saved searches. By default, saved searches included in a content pack are in deactivated state. Within this configuration, you have the flexibility to perform the following operations. (li] [/topic/topic/body/section/ol/ol/ul {""}) [/topic/topic/body/section/ol/ol/ul/li {""}) [/topic/topic/body/section/ol/ol/ul/li/b {""}) Activate all saved searches (b]: By selecting this option, you can activate all the saved searches associated with the content pack. (li] [/topic/topic/body/section/ol/ol/ul/li {""}) [/topic/topic/body/section/ol/ol/ul/li/b {""}) Deactivate all saved searches (b]: By selecting this option, you can deactivate all the saved searches associated with the content pack. (li] [/topic/topic/body/section/ol/ol/ul/li {""}) [/topic/topic/body/section/ol/ol/ul/li/b {""}) Retain current status of saved searches (b]: This option allows you to preserve the existing status of the saved searches within the content pack, ensuring they remain unchanged. (li] (ul] [/topic/topic/body/section/ol/ol/li {""}) [/topic/topic/body/section/ol/ol/li/b {""}) Add a prefix to your new objects (b]: You can optionally append a custom prefix to each object installed from the content pack. For example, you might prefix your objects with CP- to indicate they came from a content pack. This optional prefix can help you locate and manage the objects after installation. (li] [/topic/topic/body/section/ol/ol/li {""}) [/topic/topic/body/section/ol/ol/li/b {""}) Backfill service KPIs (b]: Optionally backfill your ITSI environment with the previous seven days of KPI data. Consider enabling backfill if you want to configure adaptive thresholding and predictive analytics for the new services. This setting only applies to KPIs, not service health scores. (li] (ol] [/topic/topic/body/section/ol/li {""}) When you're satisfied with your selections, click [/topic/topic/body/section/ol/li/b {""}) Install selected (b]. (li] [/topic/topic/body/section/ol/li {""}) Click [/topic/topic/body/section/ol/li/b {""}) Install (b] to confirm the installation. When the installation completes, you can view all objects that were successfully installed in your environment. A green checkmark next to the name of a content pack on the Data Integrations page indicates which content packs you've already installed. (li]

The build_winfra_lookup saved search is required to use the dashboards in the content pack. The search fills the lookup tables that populate the dashboards and reports in the content pack.

Before running the search, make sure that data is populating the indexes, whether they're the original four, or custom indexes you've created. Data ingestion must be set up before you can run search successfully. For information about the indexes that the content pack expects and how to create them, see Create the required indexes.

After glancing at the indexes to verify data ingestion, perform the following steps to run the saved searches:

1. In Splunk Web, go to the Settings menu and select Searches, reports, and alerts.
2. Search for the build_winfra_lookup saved search.
3. Run the search and verify that all the searches included in the build_winfra_lookup search have run.

The following list shows the saved searches included in the build_winfra_lookup:

• WinApp_Lookup_Build_Perfmon - Update - Server
• WinApp_Lookup_Build_Printmon - Update
• WinApp_Lookup_Build_Netmon - Update - Server
• WinApp_Lookup_Build_Hostmon_Process - Update - Detail
• WinApp_Lookup_Build_Hostmon_FS - Update - Detail
• WinApp_Lookup_Build_Hostmon_Machine - Update - Detail
• WinApp_Lookup_Build_Hostmon - Update - Server
• WinApp_Lookup_Build_Event - Update - Server
• ActiveDirectory: Update Computer Lookup
• ActiveDirectory: Update User Lookup
• ActiveDirectory: Update Group Lookup
• ActiveDirectory: Update GPO Lookup
• SiteInfo_Lookup_Update
• tHostInfo_Lookup_Update
• HostToDomain_Lookup_Update
• DomainSelector_Lookup

To collect AD data in a Splunk metric index, perform the following steps:

1. In the inputs.conf file of your local folder, update/add the NTDS source with the following configuration as per your ITSI version
[/topic/topic/body/section/ol/codeblock {""}) ##If you are using ITSI version 4.13.0 or higher, then update stanza with the configuration below## [perfmon://NTDS] object = NTDS counters = DRA Inbound Properties Total/sec; AB Browses/sec; DRA Inbound Objects Applied/sec; DS Threads in Use; AB Client Sessions; DRA Pending Replication Synchronizations; DRA Inbound Object Updates Remaining in Packet; DS Security Descriptor sub-operations/sec; DS Security Descriptor Propagations Events; LDAP Client Sessions; LDAP Active Threads; LDAP Writes/sec; LDAP Searches/sec; DRA Outbound Objects/sec; DRA Outbound Properties/sec; DRA Inbound Values Total/sec; DRA Sync Requests Made; DRA Sync Requests Successful; DRA Sync Failures on Schema Mismatch; DRA Inbound Objects/sec; DRA Inbound Properties Applied/sec; DRA Inbound Properties Filtered/sec; DS Monitor List Size; DS Notify Queue Size; LDAP UDP operations/sec; DS Search sub-operations/sec; DS Name Cache hit rate; DRA Highest USN Issued (Low part); DRA Highest USN Issued (High part); DRA Highest USN Committed (Low part); DRA Highest USN Committed (High part); DS % Writes from SAM; DS % Writes from DRA; DS % Writes from LDAP; DS % Writes from LSA; DS % Writes from KCC; DS % Writes from NSPI; DS % Writes Other; DS Directory Writes/sec; DS % Searches from SAM; DS % Searches from DRA; DS % Searches from LDAP; DS % Searches from LSA; DS % Searches from KCC; DS % Searches from NSPI; DS % Searches Other; DS Directory Searches/sec; DS % Reads from SAM; DS % Reads from DRA; DRA Inbound Values (DNs only)/sec; DRA Inbound Objects Filtered/sec; DS % Reads from LSA; DS % Reads from KCC; DS % Reads from NSPI; DS % Reads Other; DS Directory Reads/sec; LDAP Successful Binds/sec; LDAP Bind Time; SAM Successful Computer Creations/sec: Includes all requests; SAM Machine Creation Attempts/sec; SAM Successful User Creations/sec; SAM User Creation Attempts/sec; SAM Password Changes/sec; SAM Membership Changes/sec; SAM Display Information Queries/sec; SAM Enumerations/sec; SAM Transitive Membership Evaluations/sec; SAM Non-Transitive Membership Evaluations/sec; SAM Domain Local Group Membership Evaluations/sec; SAM Universal Group Membership Evaluations/sec; SAM Global Group Membership Evaluations/sec; SAM GC Evaluations/sec; DRA Inbound Full Sync Objects Remaining; DRA Inbound Bytes Total/sec; DRA Inbound Bytes Not Compressed (Within Site)/sec; DRA Inbound Bytes Compressed (Between Sites, Before Compression)/sec; DRA Inbound Bytes Compressed (Between Sites, After Compression)/sec; DRA Outbound Bytes Total/sec; DRA Outbound Bytes Not Compressed (Within Site)/sec; DRA Outbound Bytes Compressed (Between Sites, Before Compression)/sec; DRA Outbound Bytes Compressed (Between Sites, After Compression)/sec; DS Client Binds/sec; DS Server Binds/sec; DS Client Name Translations/sec; DS Server Name Translations/sec; DS Security Descriptor Propagator Runtime Queue; DS Security Descriptor Propagator Average Exclusion Time; DRA Outbound Objects Filtered/sec; DRA Outbound Values Total/sec; DRA Outbound Values (DNs only)/sec; AB ANR/sec; AB Property Reads/sec; AB Searches/sec; AB Matches/sec; AB Proxy Lookups/sec; ATQ Threads Total; ATQ Threads LDAP; ATQ Threads Other; DRA Inbound Bytes Total Since Boot; DRA Inbound Bytes Not Compressed (Within Site) Since Boot; DRA Inbound Bytes Compressed (Between Sites, Before Compression) Since Boot; DRA Inbound Bytes Compressed (Between Sites, After Compression) Since Boot; DRA Outbound Bytes Total Since Boot; DRA Outbound Bytes Not Compressed (Within Site) Since Boot; DRA Outbound Bytes Compressed (Between Sites, Before Compression) Since Boot; DRA Outbound Bytes Compressed (Between Sites, After Compression) Since Boot; LDAP New Connections/sec; LDAP Closed Connections/sec; LDAP New SSL Connections/sec; DRA Pending Replication Operations; DRA Threads Getting NC Changes; DRA Threads Getting NC Changes Holding Semaphore; DRA Inbound Link Value Updates Remaining in Packet; DRA Inbound Total Updates Remaining in Packet; DS % Writes from NTDSAPI; DS % Searches from NTDSAPI; DS % Reads from NTDSAPI; SAM Account Group Evaluation Latency; SAM Resource Group Evaluation Latency; ATQ Outstanding Queued Requests; ATQ Request Latency; ATQ Estimated Queue Delay; Tombstones Garbage Collected/sec; Phantoms Cleaned/sec; Link Values Cleaned/sec; Tombstones Visited/sec; Phantoms Visited/sec; NTLM Binds/sec; Negotiated Binds/sec; Digest Binds/sec; Simple Binds/sec; External Binds/sec; Fast Binds/sec; Base searches/sec; Subtree searches/sec; Onelevel searches/sec; Database adds/sec; Database modifys/sec; Database deletes/sec; Database recycles/sec; Approximate highest DNT; Transitive operations/sec; Transitive suboperations/sec; Transitive operations milliseconds run interval = 60 disabled = 0 mode = single useEnglishOnly=true index = itsi_im_metrics sourcetype=PerfmonMetrics:NTDS ##If you are using ITSI version 4.13.0 or lower, then update stanza with the configuration below## [perfmon://NTDS] object = NTDS counters = DRA Inbound Properties Total/sec; AB Browses/sec; DRA Inbound Objects Applied/sec; DS Threads in Use; AB Client Sessions; DRA Pending Replication Synchronizations; DRA Inbound Object Updates Remaining in Packet; DS Security Descriptor sub-operations/sec; DS Security Descriptor Propagations Events; LDAP Client Sessions; LDAP Active Threads; LDAP Writes/sec; LDAP Searches/sec; DRA Outbound Objects/sec; DRA Outbound Properties/sec; DRA Inbound Values Total/sec; DRA Sync Requests Made; DRA Sync Requests Successful; DRA Sync Failures on Schema Mismatch; DRA Inbound Objects/sec; DRA Inbound Properties Applied/sec; DRA Inbound Properties Filtered/sec; DS Monitor List Size; DS Notify Queue Size; LDAP UDP operations/sec; DS Search sub-operations/sec; DS Name Cache hit rate; DRA Highest USN Issued (Low part); DRA Highest USN Issued (High part); DRA Highest USN Committed (Low part); DRA Highest USN Committed (High part); DS % Writes from SAM; DS % Writes from DRA; DS % Writes from LDAP; DS % Writes from LSA; DS % Writes from KCC; DS % Writes from NSPI; DS % Writes Other; DS Directory Writes/sec; DS % Searches from SAM; DS % Searches from DRA; DS % Searches from LDAP; DS % Searches from LSA; DS % Searches from KCC; DS % Searches from NSPI; DS % Searches Other; DS Directory Searches/sec; DS % Reads from SAM; DS % Reads from DRA; DRA Inbound Values (DNs only)/sec; DRA Inbound Objects Filtered/sec; DS % Reads from LSA; DS % Reads from KCC; DS % Reads from NSPI; DS % Reads Other; DS Directory Reads/sec; LDAP Successful Binds/sec; LDAP Bind Time; SAM Successful Computer Creations/sec: Includes all requests; SAM Machine Creation Attempts/sec; SAM Successful User Creations/sec; SAM User Creation Attempts/sec; SAM Password Changes/sec; SAM Membership Changes/sec; SAM Display Information Queries/sec; SAM Enumerations/sec; SAM Transitive Membership Evaluations/sec; SAM Non-Transitive Membership Evaluations/sec; SAM Domain Local Group Membership Evaluations/sec; SAM Universal Group Membership Evaluations/sec; SAM Global Group Membership Evaluations/sec; SAM GC Evaluations/sec; DRA Inbound Full Sync Objects Remaining; DRA Inbound Bytes Total/sec; DRA Inbound Bytes Not Compressed (Within Site)/sec; DRA Inbound Bytes Compressed (Between Sites, Before Compression)/sec; DRA Inbound Bytes Compressed (Between Sites, After Compression)/sec; DRA Outbound Bytes Total/sec; DRA Outbound Bytes Not Compressed (Within Site)/sec; DRA Outbound Bytes Compressed (Between Sites, Before Compression)/sec; DRA Outbound Bytes Compressed (Between Sites, After Compression)/sec; DS Client Binds/sec; DS Server Binds/sec; DS Client Name Translations/sec; DS Server Name Translations/sec; DS Security Descriptor Propagator Runtime Queue; DS Security Descriptor Propagator Average Exclusion Time; DRA Outbound Objects Filtered/sec; DRA Outbound Values Total/sec; DRA Outbound Values (DNs only)/sec; AB ANR/sec; AB Property Reads/sec; AB Searches/sec; AB Matches/sec; AB Proxy Lookups/sec; ATQ Threads Total; ATQ Threads LDAP; ATQ Threads Other; DRA Inbound Bytes Total Since Boot; DRA Inbound Bytes Not Compressed (Within Site) Since Boot; DRA Inbound Bytes Compressed (Between Sites, Before Compression) Since Boot; DRA Inbound Bytes Compressed (Between Sites, After Compression) Since Boot; DRA Outbound Bytes Total Since Boot; DRA Outbound Bytes Not Compressed (Within Site) Since Boot; DRA Outbound Bytes Compressed (Between Sites, Before Compression) Since Boot; DRA Outbound Bytes Compressed (Between Sites, After Compression) Since Boot; LDAP New Connections/sec; LDAP Closed Connections/sec; LDAP New SSL Connections/sec; DRA Pending Replication Operations; DRA Threads Getting NC Changes; DRA Threads Getting NC Changes Holding Semaphore; DRA Inbound Link Value Updates Remaining in Packet; DRA Inbound Total Updates Remaining in Packet; DS % Writes from NTDSAPI; DS % Searches from NTDSAPI; DS % Reads from NTDSAPI; SAM Account Group Evaluation Latency; SAM Resource Group Evaluation Latency; ATQ Outstanding Queued Requests; ATQ Request Latency; ATQ Estimated Queue Delay; Tombstones Garbage Collected/sec; Phantoms Cleaned/sec; Link Values Cleaned/sec; Tombstones Visited/sec; Phantoms Visited/sec; NTLM Binds/sec; Negotiated Binds/sec; Digest Binds/sec; Simple Binds/sec; External Binds/sec; Fast Binds/sec; Base searches/sec; Subtree searches/sec; Onelevel searches/sec; Database adds/sec; Database modifys/sec; Database deletes/sec; Database recycles/sec; Approximate highest DNT; Transitive operations/sec; Transitive suboperations/sec; Transitive operations milliseconds run interval = 60 disabled = 0 mode = single useEnglishOnly=true index = itsi_im_metrics (codeblock] [/topic/topic/body/section/ol/li {""}) Restart your Splunk Enterprise to enable the new configuration. (li]

The content pack includes one entity discovery search which is disabled by default. When you are ready to get your data in, follow these steps to enable the entity discovery search for Windows Dashboards and Reports. You must have administrator rights to perform the following steps:

1. In Splunk Enterprise go to Settings > Searches, reports, and alerts.
2. In the Type dropdown, select All.
3. In the App dropdown, select Content Pack for Windows Dashboards and Reports (DA-ITSI-CP-windows-dashboards).
4. In the Owner dropdown, select All.
5. Select Edit > Enable to enable the saved search ITSI Import Objects - Import Active Directory Entity