Getting Data In

What is the best way to find computer usage statistics from Active Directory and CSV data sources?

alexlomas
Path Finder

Sorry for the question, I can't think of a sane & sensible way to get the data out of Splunk in a computationally efficient way:

Our data sources:

  • Active directory security events
  • CSVs of computer names & categories (e.g. computer*x*:public, computer*y*,private)

We want to look at the people usage of computers, but for only a subset of the computers - eg how many people used "public" computers for each hour over the last month.

Taking each computer name in turn and getting Splunk to search through the AD events looking for logons is very slow (the AD logs are 30GB+ a day). I've thought of creating a summary index with just some of the data but I can't quite figure out the best way of doing this.

Does anyone have any suggestions as to the "right" approach to take for getting these answers?

0 Karma
1 Solution

alexlomas
Path Finder

Never used data models before but they seem to fit the bill perfectly, thanks!

0 Karma
Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...