Configure the Splunk Add-on for Microsoft Active Directory
The Splunk Add-on for Microsoft Active Directory does not require configuration as packaged by Splunk. To gain the knowledge that the add-on provides, install it into universal forwarders on your Active Directory domain controllers. If a Windows host performs both Active Directory Domain Services and DNS Server roles, install both it and the Splunk Add-on for Windows DNS into the same universal forwarder.
Additionally, to get the search time extractions that the add-on provides, install both this add-on and the Splunk Add-on for Windows DNS into the indexers that receive the Active Directory and DNS data, and any search heads that connect to and search those indexers.
Install the Splunk Add-on for Microsoft Active Directory
Troubleshoot the Splunk Add-ons for Microsoft Active Directory
This documentation applies to the following versions of Splunk® Add-on for Microsoft Active Directory: 1.0.0, 1.0.1