Getting Data In

Input Google Workspace logs of specific users?

yanjingz
Splunk Employee
Splunk Employee

The GWS is running for the whole company.

Is it possible to only input a part of users' logs into Splunk, using add-on for GWS or some filter function somewhere?

If I only want to monitor members from a specific department of my organization, how can I filter on GWS?

I think logs could be filtered while sending to Splunk by GCP, but what about directly using GWS add-on?

Maybe this question is more about Google Service....

Anyone familiar please kindly help, thank you! 

Labels (3)
0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

Yes, this is possible. I can add the filter, but it will be 1to1, so 1 input per user to monitor. If you have 100s of users to monitor, that will become cumbersome to manage.

Did you have an idea on how multiple users would be configured in the UI?

0 Karma
Get Updates on the Splunk Community!

Splunk Classroom Chronicles: Training Tales and Testimonials

Welcome to the "Splunk Classroom Chronicles" series, created to help curious, career-minded learners get ...

Access Tokens Page - New & Improved

Splunk Observability Cloud recently launched an improved design for the access tokens page for better ...

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

🍂 Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...