We have multiple forests each with a single domain being monitored by Splunk and the Splunk App for Active Directory. Two of the domains (each a separate forest) have the same site name. When viewing the Site Status Report (Operations->Domain Controllers->Site Status), the intersite topology generator is displayed from DOMAIN-A despite selecting a different forest or domain. Both the subnets and the site links merge data from the two domains in the display.
Is there a way to configure Splunk or the Splunk App for Active Directory to differentiate the site name or correlate it with the forest/domain when generating the report?
