Getting Data In

Trimming Event Logs from a Domain Controller



I need some help in managing some logging to my Splunk server. We have an enterprise-wide set of Domain Controllers. Using this is a particular network segment that I need to monitor. I need to monitor the System & Security event log on the DC, but I need to trim the events so that the Splunk Aggregator only gets events from this subset (devices, users in specific OU/subnets). The enterprise wide logs would absolute pummel my Splunk instance.

What is the best way to trim the event log? I know that this is probably an incomplete question so I may need some guidance on what other information would help.

Thanks in advance.


Tags (1)
0 Karma

Splunk Employee
Splunk Employee

The technical answer is that you can filter using regular expressions. Examples are in the documentation on page Route and Filter data

In practise in your scenario I'd configure multiple filters with the different types of data you are interested in.


Thanks for your suggestions. I will look into that. I have used transforms/props to filter out certain data but that was usually looking for a specific event code. In this I want everything that has to do with either users or computers in a specific OU tree subset of the whole domain....

0 Karma
Get Updates on the Splunk Community!

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...