Getting Data In

Admon duplicating logs

TheCityRich
New Member

Hey everyone, I'm having some small issues with my new Splunk setup in regards to AD logging. I have a few domain controllers that I just setup to receive updates from our Deployment Server (Windows_TA app). My original issue was figuring out how to get admon logs to go to our index=msad rather than the default index=main. I was able to partially fix that issue by modifying the inputs.conf file in the deployment-app. Now the logs are being sent to the correct index=msad.

However, admon logs are also still being sent to index=main. We now have admon data duplication between 2 indexes. Does anyone have any ideas on how to get the DC's to stop sending admon logs to index=main? Preferably some configuration i could push from our Deployment Server? This is an example of a stanza in our inputs.conf that is being pushed to the DC's from Deployment Server:

 

[admon://ADMonitoring]

targetDc = DC102

monitorSubtree = 1

baseline = 0

index = msad

disabled = false

Labels (2)
0 Karma

codebuilder
SplunkTrust
SplunkTrust

When you push out an app/configs from the DS they get merged into the "default" directory on your forwarders. If you modify it manually or through the web ui those are stored under "local". My guess is that you have a version of inputs.conf under the local directory. Delete that file and cycle the service.

----
An upvote would be appreciated and Accept Solution if it helps!
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...