Splunk ADD-on for Active Directory

[amitnarendrasin]

Hi, We already have Splunk 7.1.2 deployed in our environment and its collecting logs from all our domain controllers and parsing it. Since, AD related logs are already being gathered and stored in Splunk then what is the need of Splunk ADD-on for Active Directory. what special features it has than our regular log gathering process. Why should i deploy Splunk ADD-on for Active Directory in my environment when currently deployed Splunk is already doing the same job of collecting AD logs?

[sduff_splunk]

The Splunk add-on for Active Directory contains knowledge objects to help extract information from the events you are collecting. It does not collect the events themselves, necessarily. I would recommend you install it to ensure that the fields that are being extracted are consistent, which may be useful if you deploy other Splunk apps.