We have multiple forests each with a single domain being monitored by Splunk and the Splunk App for Active Directory. Two of the domains (each a separate forest) have the same site name. When viewing the Site Status Report (Operations->Domain Controllers->Site Status), the intersite topology generator is displayed from DOMAIN-A despite selecting a different forest or domain. Both the subnets and the site links merge data from the two domains in the display.
Is there a way to configure Splunk or the Splunk App for Active Directory to differentiate the site name or correlate it with the forest/domain when generating the report?
Thanks for the bug report. I've filed it in our system and we will investigate and get it fixed.
Thanks for the bug report. I've filed it in our system and we will investigate and get it fixed.