Splunk AD Monitoring: Replace Host with dcName

[morethanyell]

Hi Community,

I'm no Windows expert and just trying to tune an alert that we have in place. It's firing whenever a UF that has `admon` has stopped sending `admon` logs.

But I just noticed that `admon` logs can have similar `dcName` in multiple UFs. For example,  a UF that's meta host is "serverA" sends `admon` logs for dcName="serverDC". And UF that's meta host is "serverB" also sends `admon` logs for dcName="serverDC".

Would it be reasonable to just replace the host of the UF with the value for dcName under the ActiveDirectory props.conf stanza?

Thanks.