Getting Data In

inputs.conf and multiple windows AD DC entries

gsawyer1
Engager

for each [WinEventLog: ] stanza in inputs.conf, can you specify more than one entry for evt_dc_name? Because what if one of the DCs goes down? Same question in relation to setting up LDAP authentication - can you specify more than one host/DC in the authentication.conf file, for redundancy?

Tags (1)
0 Karma

gkanapathy
Splunk Employee
Splunk Employee

No you can not, but you can specify a DNS name that might point to a load-balanced/failover set of AD/LDAP servers.

For example, AD domains are often set up such that the AD domain domainname.company.com resolves to list of available DCs for that domain.

Get Updates on the Splunk Community!

Splunk Enterprise Security: Your Command Center for PCI DSS Compliance

Every security professional knows the drill. The PCI DSS audit is approaching, and suddenly everyone's asking ...

Developer Spotlight with Guilhem Marchand

From Splunk Engineer to Founder: The Journey Behind TrackMe    After spending over 12 years working full time ...

Cisco Catalyst Center Meets Splunk ITSI: From 'Payments Are Down' to Root Cause in ...

The Problem: When Networks and Services Don't Talk Payment systems fail at a retail location. Customers are ...