Input Google Workspace logs of specific users?

[yanjingz]

The GWS is running for the whole company.

Is it possible to only input a part of users' logs into Splunk, using add-on for GWS or some filter function somewhere?

If I only want to monitor members from a specific department of my organization, how can I filter on GWS?

I think logs could be filtered while sending to Splunk by GCP, but what about directly using GWS add-on?

Maybe this question is more about Google Service....

Anyone familiar please kindly help, thank you! 

[alacercogitatus]

Yes, this is possible. I can add the filter, but it will be 1to1, so 1 input per user to monitor. If you have 100s of users to monitor, that will become cumbersome to manage.

Did you have an idea on how multiple users would be configured in the UI?