Splunk® Supporting Add-on for Active Directory

Deploy and Use the Splunk Supporting Add-on for Active Directory (SA-LDAPSearch)

Acrobat logo Download manual as PDF


Acrobat logo Download topic as PDF

Platform and hardware requirements

This topic discusses the underlying requirements for running the Splunk Supporting Add-on for Active Directory.

Hardware and Operating System requirements

Hardware requirements

The Splunk Supporting Add-on for Active Directory has memory, CPU, and disk requirements that meet standard hardware requirements for the core Splunk Enterprise platform. Deploy hardware that meets or exceeds these hardware requirements.

Operating system requirements

You can install the add-on on Splunk Enterprise instances that run a supported operating system. See the list of supported Windows and *nix operating systems.

What versions of Splunk does the add-on support?

The following table provides compatibility information for the Splunk Supporting Add-on for Active Directory versions and supported Splunk platform versions.

Compatible Splunk platform version Compatible SA-LDAPSearch version
7.0.x to 7.1.x 2.1.7
7.0.x to 7.2.x 2.1.8
7.0.x to 7.2.x 2.2.0
7.1.x to 7.3.x 2.2.1
7.2.x to 8.0.x 3.0.0
7.2.x to 8.1.0 3.0.1
7.3.x to 8.2.0 3.0.2
8.0.x to 8.2.0 3.0.3

What versions of Active Directory does the add-on support?

The Splunk Supporting Add-on for Active Directory supports the following versions of Active Directory:

  • Microsoft Windows Server 2008 Active Directory Domain Services
  • Microsoft Windows Server 2008 R2 Active Directory Domain Services
  • Microsoft Windows Server 2012 Active Directory Domain Services
  • Microsoft Windows Server 2012 R2 Active Directory Domain Services
  • Microsoft Windows Server 2016 Active Directory Domain Services

The add-on does not support AD Lightweight Directory Services (AD LDS) or other Lightweight Directory Access Protocol (LDAP) server types.

Distributed installation of this add-on

This table provides a quick reference for installing this add-on onto a distributed deployment of Splunk Enterprise.

Splunk instance type Supported Required Comments
Search Heads Yes Yes The host must have access to the domain controller for the domain or forest you want to get events from. The configurations you make must be identical across the search head and all search peers.
Indexers On search peers only Depends If the indexer acts as a search peer, then you must install it on all indexers that act as search peers. The search peers must have access to the domain controller for the domain or forest you want to get events from. Additionally, the configurations you make must be identical across the search head and all other search peers.
Heavy Forwarders Yes No In this configuration, you can route events from the add-on to other Splunk Enterprise instances based on the target index, or filter the data to extract only the events you want.
Universal Forwarders No No The add-on does not perform any function when you install it on this type of Splunk instance.
Light Forwarders No No The add-on does not perform any function when you install it on this type of Splunk instance. Also, light forwarder functionality has been deprecated and could be removed in a future version of the Splunk software.

Distributed deployment compatibility

This table provides a quick reference for the compatibility of this add-on with Splunk distributed deployment features.

Distributed deployment feature Supported Comments
Search Head Clusters Yes Configure your search head cluster first, then perform an installation of the add-on. The cluster replicates the configurations.
Indexer Clusters No
Deployment Server Yes You can deploy the add-on to search heads.

What are the other prerequisites?

Capability Required for
admin_all_objects This capability is required if the user needs to configure the

LDAP domains.

list_settings This capability is required if the user wants to use the LDAP search commands

on the SSL enabled domains, The Add-on requires the list_settings capability to read the sslConfig setting from the server.conf

list_storage_password This capability is required If the user wants to use LDAP search commands. To configure the LDAP domain, the list_storage_password capability is required.
Last modified on 14 July, 2021
PREVIOUS
How to get support and find more information about Splunk Enterprise
  NEXT
Install the Splunk Supporting Add-on for Active Directory

This documentation applies to the following versions of Splunk® Supporting Add-on for Active Directory: 3.0.3


Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters