I have a network with several security zones, each with their own domain, and each with their own Heavy Forwarder. (e.g. Domain XYZ) There are very restrictive firewalls between these zones.
All events from all domains end up on my management zone's indexer and accessed by SH on the same management zone. (e.g. domain ABC)
Currently, it seems that the "ldapsearch" input cannot be distributed back to each of the Heavy Forwarders on domain XYZ and is only executed on my management domain ABC.
According to company policy and network design principles, the management zone splunk instances cannot be allow to perform LDAP queries directly to other domains (XYZ) which are considered more secure.
How can I either instruct the Heavy Forwarders on other domains to execute the ldapsearch on my behalf, or perform these searches on schedule for me to get the information into the index?
Is it possible to instruct the Heavy Forwarder of domain XYZ to perform the ldapsearch on behalf of the search head in domain ABC?
