All Apps and Add-ons

Is it possible to install the Splunk Support for Active Directory add-on on the Domain Controller with a universal forwarder?

Path Finder


Is it possible or does it make sense to install the Splunk Support for Active Directory add-on on the domain controller with the universal forwarder?
The topology is as follows: Domain Controller with universal Forwarder ---> WAN -->> Heavy Forwarder DMZ ---> Indexer LAN.

The problem is there is no VPN form Indexer to the Domain Controller. I have to use the ssl/tls encryption, but I am not allowed to change any firewall settings. My Problem is how can sa-ldapserach authenticate to the DC?

Any Ideas? How could we design this?

0 Karma


Best you can do is install a heavy forwarder on the domain controller:

But then you'll have to configure your searches on the domain controller itself and maybe send data into summary indexes in the indexer cluster.

What is it you're hoping to get from the add on? Are you using it for the built in commands?

0 Karma
Get Updates on the Splunk Community!

Splunk Security Content for Threat Detection & Response, Q1 Roundup

Join Principal Threat Researcher, Michael Haag, as he walks through:An introduction to the Splunk Threat ...

Splunk Life | Happy Pride Month!

Happy Pride Month, Splunk Community! 🌈 In the United States, as well as many countries around the ...

SplunkTrust | Where Are They Now - Michael Uschmann

The Background Five years ago, Splunk published several videos showcasing members of the SplunkTrust to share ...