Getting Data In

How to do LDAP audit/access logs integration with Splunk?


Hi team,

I am new to Splunk please help me here

We have integrated one Algosec application with SPlunk Via Syslog method and collecting Audit logs

Means successful login/ unsuccessful login to Algosec Application. In logs we are getting only Algosec application IP but not source IP(Which is actually trying to login). We have checked in AD logs based on username, target IP(Algosec IP) as well but not able see any information of source IP. 

LDAP configuration is done on Algosec application

So my question is which method is useful to get actual source IP

1. Could I get Source IP in Ldap audit logs via event viewer. if yes then how I can forward this logs to Splunk from Event viewer

Windows Event Viewer > Applications and Services Logs > Directory Service

2. Splunk Supporting Add-on for Active Directory (SA-LDAPSearch)- This Ad-on is useful to get LDAP audit logs to find out source IP

Tags (2)
0 Karma


 Could I get Source IP in Ldap audit logs via event viewer?

* I'm not sure if someone in the Splunk community knows about it. But this is more of a Windows/AD question.


if yes then how I can forward this logs to Splunk from Event viewer

* There is WinEventLog input that comes pre-bundled with Splunk that you can use.

* For example, Windows Defender logs present under Microsoft > Windows > Windows Defender > Operational logs on EventViewer. That you can collect with [WinEventLog:Microsoft-Windows-Windows Defender/Operational] input stanza.

* If you can see the details in EventViewer there seems like a way to get that into Splunk.

* Reference -


On a side note please make sure you have read this, because chances are it already has answer to what you are looking for.

* Admon Inputs -

* Windows Add-on -


0 Karma


Hi Team, Please update on this

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk Cloud Platform 9.1.2308?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2308! Analysts can ...

Index This | Why do they call it hyper text?

November 2023 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

State of Splunk Careers 2023: Career Resilience and the Continued Value of Splunk

For the past three years, Splunk has partnered with Enterprise Strategy Group to conduct a survey that gauges ...