Does the Splunk App for Windows Infrastructure support having separate Active Directory forests?

[sat94541]

We currently have our main Active Directory forest in Splunk. However, we have a secondary forest that shares the same namespace. What would be your recommendation:

• Have separate indexes for each forest and two copies of the app? (I realize that this would require a lot of customization with save searches, etc within the app)
• Have both forests within the same indexes? Does the Infrastructure App support having separate Active Directory forest?

[rbal_splunk · Accepted solution]

the winfra app does support multiple forests. By default, the app expects that all the AD data across all forests is in the same set of indexes.