What is the frequency a universal forwarder will call the Domain Controller to resolve Active Directory Objects (evt_dc_name / evt_dns_name)?

[junxianli]

Hi everyone,

It is possible to set the evt_dc_name / evt_dns_name to direct to a DC to resolve AD objects. I'll be setting the DC's fqdn into the inputs.conf for one of the universal forwarders sitting in a Windows machine.

Can I know the behavior or frequency that UF will call "ping" or "query" the DC to resolve the AD objects?

Is it safe to assume that it is by per event?

My aim is to understand and not allow the the Splunk UF instance to overload the DC with "queries".

[cphair · Accepted solution]

It's not once per event, it's once per SID. One event with a lot of SIDs causes multiple lookups against the DC. Also note that the current forwarder behavior is to contact the PDC first and then revert to a local DC, so all the load will be initially directed against your PDC. This is supposed to be fixed in an upcoming version. If you don't have a compelling reason to enable SID resolution, I would turn it off.