All Apps and Add-ons

Is it possible to install the Splunk Support for Active Directory add-on on the Domain Controller with a universal forwarder?

nikkkc
Path Finder

Hi,

Is it possible or does it make sense to install the Splunk Support for Active Directory add-on on the domain controller with the universal forwarder?
The topology is as follows: Domain Controller with universal Forwarder ---> WAN -->> Heavy Forwarder DMZ ---> Indexer LAN.

The problem is there is no VPN form Indexer to the Domain Controller. I have to use the ssl/tls encryption, but I am not allowed to change any firewall settings. My Problem is how can sa-ldapserach authenticate to the DC?

Any Ideas? How could we design this?
thanks

0 Karma

jkat54
SplunkTrust
SplunkTrust

Best you can do is install a heavy forwarder on the domain controller:

http://docs.splunk.com/Documentation/SA-LdapSearch/latest/User/Platformandhardwarerequirements#Distr...

But then you'll have to configure your searches on the domain controller itself and maybe send data into summary indexes in the indexer cluster.

What is it you're hoping to get from the add on? Are you using it for the built in commands?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...