Traffic between forwarder and active directory

[jaykf014]

First time using splunk forwarder, sending local data and AD data to remote splunk receiver. We are finding that there is very high traffic between splunk forwarder and remote active directory server. Is there any details on why splunk forwarder would be communicating so much with active directory?

All forwarders are installed onto Windows OS. Splunk receiver is installed onto Linux OS.

Thanks.

[Drainy]

By default Splunk will read all event log data starting with the oldest logs, in this case Splunk is currently remotely reading all event logs on the AD which can be a massive drain whilst it catches up with the newest events. Particularly if you have a high level of auditing enabled.

Best bet? Let it finish.
If its impacting network performance then you could change the inputs.conf to not index historical data by setting this flag on the eventlog stanza;

current_only = 1

You will need to restart to let this change take effect.