All Apps and Add-ons

Splunk App for Windows Infrastructure: ADMON, Deployment Server and inputs.conf


I've been running through the Splunk App for Windows Infrastructure basically as a lab because it seems to cover many pieces of a Splunk deployment. I'm on the step at and it says:

"The [admon] input should only be enabled on one domain controller in a single domain. The [admon] input directly queries the Active Directory domain controllers. Enabling this input on multiple Splunk instances can disrupt your Active Directory servers and eventually make them unresponsive, preventing users from accessing needed services. "

I read in a different answers thread that the impact is really negligible and to run it on all DCs. Is this the case? Also, what is the impact if the [admon://default] disabled = 0 is deployed on to a non-DC?

Should I separate this into two apps, one for DCs, one for member servers? Or a separate application only pushed out to one DC from the deployment server to respect the "only enabled on one" rule mentioned above?

0 Karma
Get Updates on the Splunk Community!

New Learning Videos on Topics Most Requested by You! Plus This Month’s New Splunk ...

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

How I Instrumented a Rust Application Without Knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...

Splunk Community Platform Survey

Hey Splunk Community, Starting today, the community platform may prompt you to participate in a survey. The ...