Hello everyone. I am just trying to find out if the splunk ldapsearch app can be used in an environment where there are multiple domains? Specifically, the documentation states:
The ldap.conf file has two types of
stanza, all of which are required to
monitor a single domain
In our environment, we have several domains which need to be monitored. In this situation, would I need a separate search head for each domain? Or can it be configured to work with numerous domains?
Hi there. Yes, that is correct. Multiple domains can be used with the ldap.conf by adding additional domain stanzas. One search head can connect to many domains with a single ldap.conf, but it's recommended that each search head that that is used with the AD app has the sa-ldapsearch component in order to connect.
According to the app itself when setup on a test server:
"Up to 100 domains have been tested. However, there is no in-built limit on the number of domains that the commands can support."