Can I monitor several active directory domains using a single Splunk installation?

[stefstef]

I'm currently in the process of evaluating Splunk for active directory monitoring. What I'm interested in, is using it to monitor several domains using universal forwarders. What I've done so far is to set up a Splunk server using the local system account, and then I've set up universal forwarders in two domains using domain accounts and enabling active directory monitoring during the setup.

Unfortunately this isn't working for me, as initially I got some data from the AD monitor running in the same domain as the Splunk server, but that only lasted for about an hour.

Is what I'm attempting to do possible, and if so, what am I doing wrong?

[stefstef · Accepted solution]

I've got data streaming to my indexer now and that's happened without any intervention on my part. I guess I must just have been too impatient. Thanks for the reply malmoore.

[malmoore]

No problem. In theory your setup should work as described, but you should make sure that any data tied to user accounts comes into the indexer as expected.

[malmoore]

Questions for you:

• Are your UFs configured to run as a local administrator on the machines on which they are installed?

• Does the UF user have the ability to read the AD schema?

• Have you checked your splunkd.log and looked for errors on each of your forwarders? What do those errors say (in particular the UF that's not sending any data)?

• Are the domains part of the same AD forest?