Getting Data In

Splunk Enterprise install windows

srs_rjmd
New Member

I use the basic install on my domain controller and then install forwarder on other machines in the domain. and put my domain controller as the receiver. Will this allow me to set all logs from all system on the network.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I recommend installing Splunk on a different server than your domain controller to prevent Splunk and the DC from competing for the same resources. Install a forwarder on the DC and have all forwarders send their output to the Splunk server.
Either way, yes, you can see the logs from all systems on Splunk.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...