All Apps and Add-ons

Does the Splunk App for Windows Infrastructure support having separate Active Directory forests?

sat94541
Communicator

We currently have our main Active Directory forest in Splunk. However, we have a secondary forest that shares the same namespace. What would be your recommendation:

  • Have separate indexes for each forest and two copies of the app? (I realize that this would require a lot of customization with save searches, etc within the app)
  • Have both forests within the same indexes? Does the Infrastructure App support having separate Active Directory forest?
1 Solution

rbal_splunk
Splunk Employee
Splunk Employee

the winfra app does support multiple forests. By default, the app expects that all the AD data across all forests is in the same set of indexes.

View solution in original post

rbal_splunk
Splunk Employee
Splunk Employee

the winfra app does support multiple forests. By default, the app expects that all the AD data across all forests is in the same set of indexes.

Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...