Getting Data In
Highlighted

Can I monitor several active directory domains using a single Splunk installation?

Engager

I'm currently in the process of evaluating Splunk for active directory monitoring. What I'm interested in, is using it to monitor several domains using universal forwarders. What I've done so far is to set up a Splunk server using the local system account, and then I've set up universal forwarders in two domains using domain accounts and enabling active directory monitoring during the setup.

Unfortunately this isn't working for me, as initially I got some data from the AD monitor running in the same domain as the Splunk server, but that only lasted for about an hour.

Is what I'm attempting to do possible, and if so, what am I doing wrong?

Tags (1)
Highlighted

Re: Can I monitor several active directory domains using a single Splunk installation?

Splunk Employee
Splunk Employee

Questions for you:

  • Are your UFs configured to run as a local administrator on the machines on which they are installed?

  • Does the UF user have the ability to read the AD schema?

  • Have you checked your splunkd.log and looked for errors on each of your forwarders? What do those errors say (in particular the UF that's not sending any data)?

  • Are the domains part of the same AD forest?

0 Karma
Highlighted

Re: Can I monitor several active directory domains using a single Splunk installation?

Engager

I've got data streaming to my indexer now and that's happened without any intervention on my part. I guess I must just have been too impatient. Thanks for the reply malmoore.

View solution in original post

Highlighted

Re: Can I monitor several active directory domains using a single Splunk installation?

Splunk Employee
Splunk Employee

No problem. In theory your setup should work as described, but you should make sure that any data tied to user accounts comes into the indexer as expected.

0 Karma