Getting Data In

Input Google Workspace logs of specific users?

yanjingz
Splunk Employee
Splunk Employee

The GWS is running for the whole company.

Is it possible to only input a part of users' logs into Splunk, using add-on for GWS or some filter function somewhere?

If I only want to monitor members from a specific department of my organization, how can I filter on GWS?

I think logs could be filtered while sending to Splunk by GCP, but what about directly using GWS add-on?

Maybe this question is more about Google Service....

Anyone familiar please kindly help, thank you! 

Labels (3)
0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

Yes, this is possible. I can add the filter, but it will be 1to1, so 1 input per user to monitor. If you have 100s of users to monitor, that will become cumbersome to manage.

Did you have an idea on how multiple users would be configured in the UI?

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...