Getting Data In

What is the best way to find computer usage statistics from Active Directory and CSV data sources?

alexlomas
Path Finder

Sorry for the question, I can't think of a sane & sensible way to get the data out of Splunk in a computationally efficient way:

Our data sources:

  • Active directory security events
  • CSVs of computer names & categories (e.g. computer*x*:public, computer*y*,private)

We want to look at the people usage of computers, but for only a subset of the computers - eg how many people used "public" computers for each hour over the last month.

Taking each computer name in turn and getting Splunk to search through the AD events looking for logons is very slow (the AD logs are 30GB+ a day). I've thought of creating a summary index with just some of the data but I can't quite figure out the best way of doing this.

Does anyone have any suggestions as to the "right" approach to take for getting these answers?

0 Karma
1 Solution

alexlomas
Path Finder

Never used data models before but they seem to fit the bill perfectly, thanks!

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!