Trimming Event Logs from a Domain Controller

[kholleran]

Hi,

I need some help in managing some logging to my Splunk server. We have an enterprise-wide set of Domain Controllers. Using this is a particular network segment that I need to monitor. I need to monitor the System & Security event log on the DC, but I need to trim the events so that the Splunk Aggregator only gets events from this subset (devices, users in specific OU/subnets). The enterprise wide logs would absolute pummel my Splunk instance.

What is the best way to trim the event log? I know that this is probably an incomplete question so I may need some guidance on what other information would help.

Thanks in advance.

Kevin

[dart]

The technical answer is that you can filter using regular expressions. Examples are in the documentation on page Route and Filter data

In practise in your scenario I'd configure multiple filters with the different types of data you are interested in.

[kholleran]

Thanks for your suggestions. I will look into that. I have used transforms/props to filter out certain data but that was usually looking for a specific event code. In this I want everything that has to do with either users or computers in a specific OU tree subset of the whole domain....