I've been running through the Splunk App for Windows Infrastructure basically as a lab because it seems to cover many pieces of a Splunk deployment. I'm on the step at https://docs.splunk.com/Documentation/MSApp/1.4.3/MSInfra/DownloadandconfiguretheSplunkAdd-onforWind... and it says:
"The [admon] input should only be enabled on one domain controller in a single domain. The [admon] input directly queries the Active Directory domain controllers. Enabling this input on multiple Splunk instances can disrupt your Active Directory servers and eventually make them unresponsive, preventing users from accessing needed services. "
I read in a different answers thread that the impact is really negligible and to run it on all DCs. Is this the case? Also, what is the impact if the [admon://default] disabled = 0 is deployed on to a non-DC?
Should I separate this into two apps, one for DCs, one for member servers? Or a separate application only pushed out to one DC from the deployment server to respect the "only enabled on one" rule mentioned above?
