We already have Splunk installed and are using it pretty heavily. The use cases consist mainly of various log files or databases, and we have provided multiple teams with dashboards for the apps/systems. Now my management would like us to evaluate Splunk as an enterprise monitoring tool. In other words, as a replacement for something like SCOM, ITM, Up.Time, etc. For us, that would mean monitoring/alerting for about 10k servers (Windows, Linux, Unix) for memory, disk, processors, services, processes, sql, exchange, web sites etc. Is anyone trying to use Splunk in that capacity and on that scale? I know the data is on the servers and there are apps out there to collect most of it. But I'm a little leery of bringing all of that data back to the infrastructure and searching on it there. As opposed to most other monitoring tools, that have an agent that receives some sort of policy and only sends alerts/status back to the infrastructure. And then there's the management of it all. Different servers with different alerting needs, thresholds, polling intervals and recurrence. Not to mention the requirement to be able to take action against a server depending on an issue, e.g. restarting service or cleaning up disk space. As is usually the case, I'm sure it can be done. But I feel like we would be shoehorning Splunk into that type of solution, and it may be more trouble than it's worth. If anyone out there has any relevant experience and could share some advice/guidance, that would be great. Thanks! ... View more

Hi all, I know this has been covered before here, but I'm still struggling with it. How do we tell Splunk to return more than 1000 users per LDAP strategy. I've tried increasing the size limit and the max number of precache users, but that hasn't helped. For example, I have a strategy right now that's filtering for 4 groups with a total number of users (nested) at about 1200. My size limit for the strategy is 5,000 and precahce users is 10,000. But I'm still receiving the Size Limit warning in my logs for that strategy. And I know the size limit configuration mentions "The number actually returned is subject to the limit imposed by the LDAP server." But that just doesn't make sense to me. Every other technology that queries AD can get around those limits. I feel like Splunk should be able to as well. Is there something I'm missing or just not understanding? It's frustrating because we just have to keep creating more and more strategies. If that's the only way, then that's what we'll do (assuming every group has less than 1000 members). But I hope there's another way now or will be in the future. We are currently on Splunk 6.0 Thanks for any insight! ... View more