Active Directory Monitoring

[seanp]

I was wondering if someone could validate an answer for me. I have installed the Universal Forwarder on a domain controller and collecting data. However, there is also the Manager » Data inputs » Active Directory monitoring within Splunk. Do these collect the same data? Can I assume that using the Universal Forwarder is the preferred method to collect AD data?

Thanks!

[ChrisG]

The Active Directory monitoring process (splunk-admon.exe) can run under your full Splunk instance or on a forwarder. If you haven't read the Monitor Active Directory documentation topic, that's a good place to start.