All Apps and Add-ons

Can splunk ldapsearch - monitor more than 1 domain?

msarro
Builder

Hello everyone. I am just trying to find out if the splunk ldapsearch app can be used in an environment where there are multiple domains? Specifically, the documentation states:

The ldap.conf file has two types of
stanza, all of which are required to
monitor a single domain

In our environment, we have several domains which need to be monitored. In this situation, would I need a separate search head for each domain? Or can it be configured to work with numerous domains?

0 Karma

jbernt_splunk
Splunk Employee
Splunk Employee

Hi there. Yes, that is correct. Multiple domains can be used with the ldap.conf by adding additional domain stanzas. One search head can connect to many domains with a single ldap.conf, but it's recommended that each search head that that is used with the AD app has the sa-ldapsearch component in order to connect.

0 Karma

msarro
Builder

According to the app itself when setup on a test server:
"Up to 100 domains have been tested. However, there is no in-built limit on the number of domains that the commands can support."

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In September, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...

New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...

The latest enhancements to the Splunk observability portfolio deliver improved SLO management accuracy, better ...

Improve Data Pipelines Using Splunk Data Management

  Register Now   This Tech Talk will explore the pipeline management offerings Edge Processor and Ingest ...