https://community.splunk.com/t5/Getting-Data-In/Active-Directory-monitor-only-users-data/m-p/44763#M8395 <P>Hi all!</P> <P>I need to import users informations from AD.<BR /> The forest has a folder for each Country, and each country has the "users" folder (Ex: OU=users, OU=Country1, OU=intranet and OU=users, OU=Country2, OU=intranet).</P> <P>I've tried to edit %SPLUNK_HOME%\bin\scripts\splunk-admon.path in this way:</P> <BLOCKQUOTE> <P>$SPLUNK_HOME\bin\splunk-admon.exe -query "(&amp;(sAMAccountType=805306368))"</P> </BLOCKQUOTE> <P>It runs without errors, but i lose the format of the sourcetype "ActiveDirectory".</P> <P>Any suggestion?<BR /> Thanks</P> Mon, 26 Nov 2012 12:25:55 GMT giorgio_adami_m 2012-11-26T12:25:55Z https://community.splunk.com/t5/Getting-Data-In/Active-Directory-monitor-only-users-data/m-p/44763#M8395 <P>Hi all!</P> <P>I need to import users informations from AD.<BR /> The forest has a folder for each Country, and each country has the "users" folder (Ex: OU=users, OU=Country1, OU=intranet and OU=users, OU=Country2, OU=intranet).</P> <P>I've tried to edit %SPLUNK_HOME%\bin\scripts\splunk-admon.path in this way:</P> <BLOCKQUOTE> <P>$SPLUNK_HOME\bin\splunk-admon.exe -query "(&amp;(sAMAccountType=805306368))"</P> </BLOCKQUOTE> <P>It runs without errors, but i lose the format of the sourcetype "ActiveDirectory".</P> <P>Any suggestion?<BR /> Thanks</P> Mon, 26 Nov 2012 12:25:55 GMT https://community.splunk.com/t5/Getting-Data-In/Active-Directory-monitor-only-users-data/m-p/44763#M8395 giorgio_adami_m 2012-11-26T12:25:55Z https://community.splunk.com/t5/Getting-Data-In/Active-Directory-monitor-only-users-data/m-p/44764#M8396 <P>It seems that it's not possible to edit the query LDAP that splunk-admon launch to the target DC.<BR /> I've solved filtering events with props/transforms before forward/index them.</P> Tue, 05 Mar 2013 10:23:20 GMT https://community.splunk.com/t5/Getting-Data-In/Active-Directory-monitor-only-users-data/m-p/44764#M8396 giorgio_adami_m 2013-03-05T10:23:20Z