I'm working on setting up multiple splunk indexers across a few geographical sites. Each site contains its own domain controller. Ideally, I'd like to have each indexer receive the data relevant for its site, and setup distributed search from our search head (easy enough).
What I'm curious about is how this plays with the Splunk App for Active Directory, and further down the line, Splunk App for VMware. Do I need to have each site independently configured with the apps/TAs/appropriate indexes as fully functional (stand alone) before the distributed search will function properly on our search head? Or can I just create relevant indexes on each indexer, but leave the TA apps + Splunk for AD app unconfigured?
Thanks in advance!
