All Apps and Add-ons

Can splunk ldapsearch - monitor more than 1 domain?

msarro
Builder

Hello everyone. I am just trying to find out if the splunk ldapsearch app can be used in an environment where there are multiple domains? Specifically, the documentation states:

The ldap.conf file has two types of
stanza, all of which are required to
monitor a single domain

In our environment, we have several domains which need to be monitored. In this situation, would I need a separate search head for each domain? Or can it be configured to work with numerous domains?

0 Karma

jbernt_splunk
Splunk Employee
Splunk Employee

Hi there. Yes, that is correct. Multiple domains can be used with the ldap.conf by adding additional domain stanzas. One search head can connect to many domains with a single ldap.conf, but it's recommended that each search head that that is used with the AD app has the sa-ldapsearch component in order to connect.

0 Karma

msarro
Builder

According to the app itself when setup on a test server:
"Up to 100 domains have been tested. However, there is no in-built limit on the number of domains that the commands can support."

0 Karma
Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

<P style=" text-align: center; "><span class="lia-inline-image-display-wrapper lia-image-align-center" ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

<FONT size="5"><FONT size="5" color="#FF00FF">Get the latest news and updates from the Splunk Community ...