topic Re: extract log files on one Active Directory OU in Splunk Dev

extract log files on one Active Directory OU

rapture005 — Wed, 01 Aug 2018 11:54:54 GMT

Possible unique situation. I work for a state agency and each state agency is under the same domain. So each state agency is its own OU in AD (I know its bad but it is the way it is). We need to extract only log files pertaining to my own agency. The group that manages AD wants to dump the logs on a share and for us to import. Is it possible to use a heavy forwarder to extract the log files for my agency only? I'm not sure if it is possible. I'm sorry if this is confusing. I'm not looking for a step by step just general info if possible.

Re: extract log files on one Active Directory OU

sudosplunk — Wed, 01 Aug 2018 12:28:55 GMT

Hello,

While HF can do the job, you can use Universal Forwarder also to ingest logs from share. It would be easy if the log files have some kind of unique name which differentiates it with other log files. Please provide some examples with screenshots or samples to further assist you.

Meanwhile, you can find good explanation with steps here.

Re: extract log files on one Active Directory OU

rapture005 — Wed, 01 Aug 2018 13:08:30 GMT

thanks for the quick response. That is what I'm afraid of how to differentiate the groups. I'm working on getting some data to test.

Re: extract log files on one Active Directory OU

sudosplunk — Wed, 01 Aug 2018 13:13:33 GMT

Can you show where logs are stored? I meant "path\to\file".
PS: Mask sensitive information(if any).