Splunk authentication is destroying my Active Directory because of frequency of authentications, our user search dn contains 100000 users, our DC's are logging around 2.5 million authentication queries a day from the Splunk service account, I have some suspicions that it is around the cache configuration, can anyone offer some advice on how to reduce this auth storm (only a 10-20 people use the app per day).
