Getting Data In

Can I monitor several active directory domains using a single Splunk installation?

stefstef
Engager

I'm currently in the process of evaluating Splunk for active directory monitoring. What I'm interested in, is using it to monitor several domains using universal forwarders. What I've done so far is to set up a Splunk server using the local system account, and then I've set up universal forwarders in two domains using domain accounts and enabling active directory monitoring during the setup.

Unfortunately this isn't working for me, as initially I got some data from the AD monitor running in the same domain as the Splunk server, but that only lasted for about an hour.

Is what I'm attempting to do possible, and if so, what am I doing wrong?

Tags (1)
1 Solution

stefstef
Engager

I've got data streaming to my indexer now and that's happened without any intervention on my part. I guess I must just have been too impatient. Thanks for the reply malmoore.

View solution in original post

stefstef
Engager

I've got data streaming to my indexer now and that's happened without any intervention on my part. I guess I must just have been too impatient. Thanks for the reply malmoore.

malmoore
Splunk Employee
Splunk Employee

No problem. In theory your setup should work as described, but you should make sure that any data tied to user accounts comes into the indexer as expected.

0 Karma

malmoore
Splunk Employee
Splunk Employee

Questions for you:

  • Are your UFs configured to run as a local administrator on the machines on which they are installed?

  • Does the UF user have the ability to read the AD schema?

  • Have you checked your splunkd.log and looked for errors on each of your forwarders? What do those errors say (in particular the UF that's not sending any data)?

  • Are the domains part of the same AD forest?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...