Splunk Forwarder not sending data from domain controller server

[ITGSOC]

Hi ,

I want to sent the application, system and security logs from the domain controller server to the main Splunk server but it is not sending it. As a workaround, I have installed Splunk Enterprise of DC servers and changed their licensing to 'Forwarder'. This method is working but the CPU and memory usage sometimes increase to the extent that my server gets hanged. 

Could you please assist me in setting up Splunk forwarder on my DC server so that the server's memory and CPU usage can be decreased. similar problem happened to my others servers but replacing the Splunk enterprise with Splunk universal forwarder resolved the issue but I can't do it for the DC servers.

[richgalloway]

The recommended method for sending DC  events to Splunk is by installing a Universal Forwarder on each DC.  It usually works well.  It's important to enable the right inputs so the UF will collect the data and forward it.

When it didn't work for you, what error(s) did you get?

Why can you not do it for the DC servers?

[ITGSOC]

When I did it for DC the logs were not sent to the server. even but the device was detected. The only difference in DC and other server is that i am also sending the security logs from DC but from the other servers i am only sending application and system logs.

[isoutamo]

Have you check that this user (which are running UF) have access to those logs in DC?