All Apps and Add-ons

What is the frequency a universal forwarder will call the Domain Controller to resolve Active Directory Objects (evt_dc_name / evt_dns_name)?

junxianli
Explorer

Hi everyone,

It is possible to set the evt_dc_name / evt_dns_name to direct to a DC to resolve AD objects. I'll be setting the DC's fqdn into the inputs.conf for one of the universal forwarders sitting in a Windows machine.

Can I know the behavior or frequency that UF will call "ping" or "query" the DC to resolve the AD objects?

Is it safe to assume that it is by per event?

My aim is to understand and not allow the the Splunk UF instance to overload the DC with "queries".

0 Karma
1 Solution

cphair
Builder

It's not once per event, it's once per SID. One event with a lot of SIDs causes multiple lookups against the DC. Also note that the current forwarder behavior is to contact the PDC first and then revert to a local DC, so all the load will be initially directed against your PDC. This is supposed to be fixed in an upcoming version. If you don't have a compelling reason to enable SID resolution, I would turn it off.

View solution in original post

cphair
Builder

It's not once per event, it's once per SID. One event with a lot of SIDs causes multiple lookups against the DC. Also note that the current forwarder behavior is to contact the PDC first and then revert to a local DC, so all the load will be initially directed against your PDC. This is supposed to be fixed in an upcoming version. If you don't have a compelling reason to enable SID resolution, I would turn it off.

Get Updates on the Splunk Community!

Exporting Splunk Apps

Join us on Monday, October 21 at 11 am PT | 2 pm ET!With the app export functionality, app developers and ...

Cisco Use Cases, ITSI Best Practices, and More New Articles from Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Build Your First SPL2 App!

Watch the recording now!.Do you want to SPL™, too? SPL2, Splunk's next-generation data search and preparation ...