Splunk Universal Forwarder

[JJ_Splunk]

Okay, I just want to make sure I understand everything correctly.

I'm currently working on a Splunk environment, it currently has a running search head & indexer and a heavy forwarder. One of the sources of data that we want to collect is the active directory. I've done some research and it seems like the recommended option would be to download a universal forwarder and install it on the domain controller of the active directory. Is that correct?

And if so is this video,

"Getting Data In — Forwarders"

the correct one I should be following?

If not, please share any videos or documents I should follow, thank you!

[gcusello]

Hi @JJ_Splunk ,

yes, the best approach to collect Domain Controller logs is to install a Universal Forwarder on the DC.

Then you should install on the DC and on the Search Head the Splunk_TA-Windows add-on (https://splunkbase.splunk.com/app/742) Then you should configure it on the DC.

Instead, if you want to exract AD structure and data, you should install on the HF the Splunk Supporting Add-On for Active Directory (https://splunkbase.splunk.com/app/1151) and connect it to the AD.

Ciao.

Giuseppe