All Apps and Add-ons

Splunk App for Windows Infrastructure: ADMON, Deployment Server and inputs.conf

wfjarrett538
Explorer

I've been running through the Splunk App for Windows Infrastructure basically as a lab because it seems to cover many pieces of a Splunk deployment. I'm on the step at https://docs.splunk.com/Documentation/MSApp/1.4.3/MSInfra/DownloadandconfiguretheSplunkAdd-onforWind... and it says:

"The [admon] input should only be enabled on one domain controller in a single domain. The [admon] input directly queries the Active Directory domain controllers. Enabling this input on multiple Splunk instances can disrupt your Active Directory servers and eventually make them unresponsive, preventing users from accessing needed services. "

I read in a different answers thread that the impact is really negligible and to run it on all DCs. Is this the case? Also, what is the impact if the [admon://default] disabled = 0 is deployed on to a non-DC?

Should I separate this into two apps, one for DCs, one for member servers? Or a separate application only pushed out to one DC from the deployment server to respect the "only enabled on one" rule mentioned above?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...