Deployment Architecture

Distributed Search, Splunk for Active Directory?

j0sh3rs
Engager

I'm working on setting up multiple splunk indexers across a few geographical sites. Each site contains its own domain controller. Ideally, I'd like to have each indexer receive the data relevant for its site, and setup distributed search from our search head (easy enough).

What I'm curious about is how this plays with the Splunk App for Active Directory, and further down the line, Splunk App for VMware. Do I need to have each site independently configured with the apps/TAs/appropriate indexes as fully functional (stand alone) before the distributed search will function properly on our search head? Or can I just create relevant indexes on each indexer, but leave the TA apps + Splunk for AD app unconfigured?

Thanks in advance!

0 Karma

dart
Splunk Employee
Splunk Employee

Does the diagram in the documentation of a distributed deployment give you the detail you need?

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...