Limit Active Directory forwarded data to just changes

[vanhooseja]

We are setting up Splunk to monitor our AD but only want to see changes in AD but currently it is pulling in all AD data and pushing us over our license limit. How can we limit the data to just changes (add/deletes)?

[michael_schmidt]

Here's a good place to start:

http://blogs.splunk.com/2012/09/21/the-splunk-app-for-active-directory-and-how-i-tamed-the-security-...

[vanhooseja]

That's what I started looking at this morning but since im over my limit I can't do that search.

[michael_schmidt]

If you're on a paid version you can call Splunk and have them reset your license, (as long as you're still implementing, and configuring, and haven't abused their graciousness...)

[vanhooseja]

they actually just did that for me for the 1st time and just got the trial license.

[vanhooseja]

Right now it is pulling in all data related to AD but we are only wanting change events like addition and deletions.

[maciep]

Could you elaborate a bit? How and what type of data are you collecting now? Are you just looking to limit which Event IDs you're collecting, for example? Or something more specific?