Splunk IT Service Intelligence

How to import Active Directory logs from another Splunk app into ITSI?

New Member

We just installed ISIT, and we're also using an app for AD object collection (MS Windows AD Objects ). I'm wondering it's it's possible to configure ISIT to use some of that existing AD data already collected? Also I was hoping to avoid having two AD related apps that might be pulling duplicate data from all Windows machines.

Labels (2)
0 Karma

Splunk Employee
Splunk Employee

Hey @mstrzelecki,

You can try using the ITSI Content Packs (https://splunkbase.splunk.com/app/5391/) and try configuring the same for AD analysis. There are multiple content packs for different purposes. You can find the description related to content packs here - https://docs.splunk.com/Documentation/ContentPackApp/1.5.0/Overview/Overview#:~:text=for%20Content%2...

If you find the answer helpful, an upvote/karma is appreciated
0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...