Hi everyone,
I have to implement a use case for a customer which basically means, monitoring AD events of ~10 Domain Controllers. Based on the documentation: Monitor Active Directory - Splunk Documentation I'm able to monitor multiple domain controllers with one inputs.conf.
Would that mean, that I don't have to install on all those 10 Domain Controller the UF? And by installing the UF on the DC, do I have to chose a domain user with AD reading right instead of a local service user?
Thank you!
