All Apps and Add-ons

Splunk App for Windows Infrastructure: ADMON, Deployment Server and inputs.conf


I've been running through the Splunk App for Windows Infrastructure basically as a lab because it seems to cover many pieces of a Splunk deployment. I'm on the step at and it says:

"The [admon] input should only be enabled on one domain controller in a single domain. The [admon] input directly queries the Active Directory domain controllers. Enabling this input on multiple Splunk instances can disrupt your Active Directory servers and eventually make them unresponsive, preventing users from accessing needed services. "

I read in a different answers thread that the impact is really negligible and to run it on all DCs. Is this the case? Also, what is the impact if the [admon://default] disabled = 0 is deployed on to a non-DC?

Should I separate this into two apps, one for DCs, one for member servers? Or a separate application only pushed out to one DC from the deployment server to respect the "only enabled on one" rule mentioned above?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...