Getting Data In

Trimming Event Logs from a Domain Controller

kholleran
Communicator

Hi,

I need some help in managing some logging to my Splunk server. We have an enterprise-wide set of Domain Controllers. Using this is a particular network segment that I need to monitor. I need to monitor the System & Security event log on the DC, but I need to trim the events so that the Splunk Aggregator only gets events from this subset (devices, users in specific OU/subnets). The enterprise wide logs would absolute pummel my Splunk instance.

What is the best way to trim the event log? I know that this is probably an incomplete question so I may need some guidance on what other information would help.

Thanks in advance.

Kevin

Tags (1)
0 Karma

dart
Splunk Employee
Splunk Employee

The technical answer is that you can filter using regular expressions. Examples are in the documentation on page Route and Filter data

In practise in your scenario I'd configure multiple filters with the different types of data you are interested in.

kholleran
Communicator

Thanks for your suggestions. I will look into that. I have used transforms/props to filter out certain data but that was usually looking for a specific event code. In this I want everything that has to do with either users or computers in a specific OU tree subset of the whole domain....

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>