https://community.splunk.com/t5/Splunk-Dev/Limit-Active-Directory-forwarded-data-to-just-changes/m-p/240362#M3056 <P>Here's a good place to start:</P> <P><A href="http://blogs.splunk.com/2012/09/21/the-splunk-app-for-active-directory-and-how-i-tamed-the-security-log/">http://blogs.splunk.com/2012/09/21/the-splunk-app-for-active-directory-and-how-i-tamed-the-security-log/</A></P> Mon, 14 Mar 2016 15:13:20 GMT michael_schmidt 2016-03-14T15:13:20Z https://community.splunk.com/t5/Splunk-Dev/Limit-Active-Directory-forwarded-data-to-just-changes/m-p/240359#M3053 <P>We are setting up Splunk to monitor our AD but only want to see changes in AD but currently it is pulling in all AD data and pushing us over our license limit. How can we limit the data to just changes (add/deletes)? </P> Fri, 11 Mar 2016 15:22:19 GMT https://community.splunk.com/t5/Splunk-Dev/Limit-Active-Directory-forwarded-data-to-just-changes/m-p/240359#M3053 vanhooseja 2016-03-11T15:22:19Z https://community.splunk.com/t5/Splunk-Dev/Limit-Active-Directory-forwarded-data-to-just-changes/m-p/240360#M3054 <P>Could you elaborate a bit? How and what type of data are you collecting now? Are you just looking to limit which Event IDs you're collecting, for example? Or something more specific? </P> Sat, 12 Mar 2016 03:08:59 GMT https://community.splunk.com/t5/Splunk-Dev/Limit-Active-Directory-forwarded-data-to-just-changes/m-p/240360#M3054 maciep 2016-03-12T03:08:59Z https://community.splunk.com/t5/Splunk-Dev/Limit-Active-Directory-forwarded-data-to-just-changes/m-p/240361#M3055 <P>Right now it is pulling in all data related to AD but we are only wanting change events like addition and deletions.</P> Mon, 14 Mar 2016 14:06:24 GMT https://community.splunk.com/t5/Splunk-Dev/Limit-Active-Directory-forwarded-data-to-just-changes/m-p/240361#M3055 vanhooseja 2016-03-14T14:06:24Z https://community.splunk.com/t5/Splunk-Dev/Limit-Active-Directory-forwarded-data-to-just-changes/m-p/240362#M3056 <P>Here's a good place to start:</P> <P><A href="http://blogs.splunk.com/2012/09/21/the-splunk-app-for-active-directory-and-how-i-tamed-the-security-log/">http://blogs.splunk.com/2012/09/21/the-splunk-app-for-active-directory-and-how-i-tamed-the-security-log/</A></P> Mon, 14 Mar 2016 15:13:20 GMT https://community.splunk.com/t5/Splunk-Dev/Limit-Active-Directory-forwarded-data-to-just-changes/m-p/240362#M3056 michael_schmidt 2016-03-14T15:13:20Z https://community.splunk.com/t5/Splunk-Dev/Limit-Active-Directory-forwarded-data-to-just-changes/m-p/240363#M3057 <P>That's what I started looking at this morning but since im over my limit I can't do that search.</P> Mon, 14 Mar 2016 15:22:30 GMT https://community.splunk.com/t5/Splunk-Dev/Limit-Active-Directory-forwarded-data-to-just-changes/m-p/240363#M3057 vanhooseja 2016-03-14T15:22:30Z https://community.splunk.com/t5/Splunk-Dev/Limit-Active-Directory-forwarded-data-to-just-changes/m-p/240364#M3058 <P>If you're on a paid version you can call Splunk and have them reset your license, (as long as you're still implementing, and configuring, and haven't abused their graciousness...)</P> Mon, 14 Mar 2016 15:46:58 GMT https://community.splunk.com/t5/Splunk-Dev/Limit-Active-Directory-forwarded-data-to-just-changes/m-p/240364#M3058 michael_schmidt 2016-03-14T15:46:58Z https://community.splunk.com/t5/Splunk-Dev/Limit-Active-Directory-forwarded-data-to-just-changes/m-p/240365#M3059 <P>they actually just did that for me for the 1st time and just got the trial license.</P> Mon, 14 Mar 2016 15:53:02 GMT https://community.splunk.com/t5/Splunk-Dev/Limit-Active-Directory-forwarded-data-to-just-changes/m-p/240365#M3059 vanhooseja 2016-03-14T15:53:02Z