topic Re: Splunk Forwarder not sending data from domain controller server in Splunk Enterprise

Splunk Forwarder not sending data from domain controller server

ITGSOC — Tue, 14 Oct 2025 12:17:14 GMT

Hi ,

I want to sent the application, system and security logs from the domain controller server to the main Splunk server but it is not sending it. As a workaround, I have installed Splunk Enterprise of DC servers and changed their licensing to 'Forwarder'. This method is working but the CPU and memory usage sometimes increase to the extent that my server gets hanged.

Could you please assist me in setting up Splunk forwarder on my DC server so that the server's memory and CPU usage can be decreased. similar problem happened to my others servers but replacing the Splunk enterprise with Splunk universal forwarder resolved the issue but I can't do it for the DC servers.

Re: Splunk Forwarder not sending data from domain controller server

richgalloway — Tue, 14 Oct 2025 12:56:48 GMT

The recommended method for sending DC events to Splunk is by installing a Universal Forwarder on each DC. It usually works well. It's important to enable the right inputs so the UF will collect the data and forward it.

When it didn't work for you, what error(s) did you get?

Why can you not do it for the DC servers?

Re: Splunk Forwarder not sending data from domain controller server

isoutamo — Tue, 14 Oct 2025 13:11:40 GMT

Have you check that this user (which are running UF) have access to those logs in DC?

Re: Splunk Forwarder not sending data from domain controller server

ITGSOC — Tue, 14 Oct 2025 13:14:07 GMT

When I did it for DC the logs were not sent to the server. even but the device was detected. The only difference in DC and other server is that i am also sending the security logs from DC but from the other servers i am only sending application and system logs.