topic Re: Trimming Event Logs from a Domain Controller in Getting Data In

Trimming Event Logs from a Domain Controller

kholleran — Wed, 29 Aug 2012 18:01:16 GMT

Hi,

I need some help in managing some logging to my Splunk server. We have an enterprise-wide set of Domain Controllers. Using this is a particular network segment that I need to monitor. I need to monitor the System & Security event log on the DC, but I need to trim the events so that the Splunk Aggregator only gets events from this subset (devices, users in specific OU/subnets). The enterprise wide logs would absolute pummel my Splunk instance.

What is the best way to trim the event log? I know that this is probably an incomplete question so I may need some guidance on what other information would help.

Thanks in advance.

Kevin

Re: Trimming Event Logs from a Domain Controller

dart — Wed, 05 Sep 2012 09:27:29 GMT

The technical answer is that you can filter using regular expressions. Examples are in the documentation on page Route and Filter data

In practise in your scenario I'd configure multiple filters with the different types of data you are interested in.

Re: Trimming Event Logs from a Domain Controller

kholleran — Tue, 11 Sep 2012 17:11:40 GMT

Thanks for your suggestions. I will look into that. I have used transforms/props to filter out certain data but that was usually looking for a specific event code. In this I want everything that has to do with either users or computers in a specific OU tree subset of the whole domain....