I am looking to see if anyone knows how to do this or if it is possible. I am trying to have splunk read to the Active directory groups that hold the certain subnets for different locations and we use it to lock down certain people being able to see these specific subnets. It is a pain to update all these subnets in splunk and the AD group since it is 2 different parties working this. I am asking if anyone knows how I can get rid of the Subnets that I am searching for in Splunk and just have to route to the AD groups that we have set up. This would eliminate the need to update Splunk dashboards and the AD groups.
