All Apps and Add-ons

Multiple Forests - Same Site Name - Merged Data in Site Status Reports

New Member

We have multiple forests each with a single domain being monitored by Splunk and the Splunk App for Active Directory. Two of the domains (each a separate forest) have the same site name. When viewing the Site Status Report (Operations->Domain Controllers->Site Status), the intersite topology generator is displayed from DOMAIN-A despite selecting a different forest or domain. Both the subnets and the site links merge data from the two domains in the display.

Is there a way to configure Splunk or the Splunk App for Active Directory to differentiate the site name or correlate it with the forest/domain when generating the report?

0 Karma
1 Solution

Splunk Employee
Splunk Employee

Thanks for the bug report. I've filed it in our system and we will investigate and get it fixed.

View solution in original post

0 Karma

Splunk Employee
Splunk Employee

Thanks for the bug report. I've filed it in our system and we will investigate and get it fixed.

View solution in original post

0 Karma