Getting Data In

inputs.conf and multiple windows AD DC entries

gsawyer1
Engager

for each [WinEventLog: ] stanza in inputs.conf, can you specify more than one entry for evt_dc_name? Because what if one of the DCs goes down? Same question in relation to setting up LDAP authentication - can you specify more than one host/DC in the authentication.conf file, for redundancy?

Tags (1)
0 Karma

gkanapathy
Splunk Employee
Splunk Employee

No you can not, but you can specify a DNS name that might point to a load-balanced/failover set of AD/LDAP servers.

For example, AD domains are often set up such that the AD domain domainname.company.com resolves to list of available DCs for that domain.

Get Updates on the Splunk Community!

Shape the Future of Splunk: Join the Product Research Lab!

Join the Splunk Product Research Lab and connect with us in the Slack channel #product-research-lab to get ...

Auto-Injector for Everything Else: Making OpenTelemetry Truly Universal

You might have seen Splunk’s recent announcement about donating the OpenTelemetry Injector to the ...

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...