topic [admon://] Stanza in All Apps and Add-ons

[admon://] Stanza

richardphung — Wed, 30 Sep 2020 00:54:46 GMT

I see that we have a separate TA for AD1.0.0 inputs, namely:
/opt/splunk/etc/deployment-apps/Splunk_TA_microsoft_ad_admon_inputs/

of which, we have a local/inputs.conf:

[admon://MYDOMAIN.ORG]
monitorSubtree = 1
baseline = 1
index = msad
disabled = false

Should this be copied to:
Splunk_TA_Windows/local/inputs.conf?

Or should we simply leave the additional TA as-is?

adonio — Fri, 14 Jun 2019 03:07:17 GMT

make sure you have only one admon inputs enabled, doesnt really matter in which TA.

bhargavnariyani — Wed, 19 Jun 2019 11:04:40 GMT

Agree with @adonio. If you want to keep everything in a single place, better move it to Windows TA.