topic Re: Target data from specific Active Directory OU's in Getting Data In

Target data from specific Active Directory OU's

Mobyd — Wed, 14 May 2025 12:11:57 GMT

Hi,

I am trying to gather data from a specific organisation unit in Active Directory and ignore everything else? I have tried with a transforms.conf to allow it but didn't seem to work. I could sort of get it to work by writing a block for everything else but its a bit of a pain as the environment is shared.

Any one had any experience doing this sort of thing?

Re: Target data from specific Active Directory OU's

livehybrid — Wed, 14 May 2025 12:26:15 GMT

Hi @Mobyd

Please could you confirm - is this using an admon:// input?

If so you should be able to specify a "startingNode" which would the OU which you would like to monitor.

https://docs.splunk.com/Documentation/Splunk/latest/admin/Inputsconf#:~:text=startingNode%20%3D%20%3Cstring%3E

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: Target data from specific Active Directory OU's

Mobyd — Wed, 14 May 2025 12:48:46 GMT

Yes, that is correct. We are using admon in the default. I'll give that a go. Also, if I wanted to also limit it by that and then the destination IP, would I use a transforms.conf for that? Many Thanks