Deployment Architecture

Distributed Search, Splunk for Active Directory?

j0sh3rs
Engager

I'm working on setting up multiple splunk indexers across a few geographical sites. Each site contains its own domain controller. Ideally, I'd like to have each indexer receive the data relevant for its site, and setup distributed search from our search head (easy enough).

What I'm curious about is how this plays with the Splunk App for Active Directory, and further down the line, Splunk App for VMware. Do I need to have each site independently configured with the apps/TAs/appropriate indexes as fully functional (stand alone) before the distributed search will function properly on our search head? Or can I just create relevant indexes on each indexer, but leave the TA apps + Splunk for AD app unconfigured?

Thanks in advance!

0 Karma

dart
Splunk Employee
Splunk Employee

Does the diagram in the documentation of a distributed deployment give you the detail you need?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...