Can splunk ldapsearch - monitor more than 1 domain?

[msarro]

Hello everyone. I am just trying to find out if the splunk ldapsearch app can be used in an environment where there are multiple domains? Specifically, the documentation states:

The ldap.conf file has two types of
stanza, all of which are required to
monitor a single domain

In our environment, we have several domains which need to be monitored. In this situation, would I need a separate search head for each domain? Or can it be configured to work with numerous domains?

[jbernt_splunk]

Hi there. Yes, that is correct. Multiple domains can be used with the ldap.conf by adding additional domain stanzas. One search head can connect to many domains with a single ldap.conf, but it's recommended that each search head that that is used with the AD app has the sa-ldapsearch component in order to connect.

[msarro]

According to the app itself when setup on a test server:
"Up to 100 domains have been tested. However, there is no in-built limit on the number of domains that the commands can support."