Getting Data In

Input Google Workspace logs of specific users?

yanjingz
Splunk Employee
Splunk Employee

The GWS is running for the whole company.

Is it possible to only input a part of users' logs into Splunk, using add-on for GWS or some filter function somewhere?

If I only want to monitor members from a specific department of my organization, how can I filter on GWS?

I think logs could be filtered while sending to Splunk by GCP, but what about directly using GWS add-on?

Maybe this question is more about Google Service....

Anyone familiar please kindly help, thank you! 

Labels (3)
0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

Yes, this is possible. I can add the filter, but it will be 1to1, so 1 input per user to monitor. If you have 100s of users to monitor, that will become cumbersome to manage.

Did you have an idea on how multiple users would be configured in the UI?

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...

Secure Your Future: Mastering Upgrade Readiness for Splunk 10

Spotlight: The Splunk Health Assistant Add-On  The Splunk Health Assistant Add-On is your ultimate companion ...

Observability Unlocked: Kubernetes & Cloud Monitoring with Splunk IM

Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team on ...