Getting Data In

Input Google Workspace logs of specific users?

yanjingz
Splunk Employee
Splunk Employee

The GWS is running for the whole company.

Is it possible to only input a part of users' logs into Splunk, using add-on for GWS or some filter function somewhere?

If I only want to monitor members from a specific department of my organization, how can I filter on GWS?

I think logs could be filtered while sending to Splunk by GCP, but what about directly using GWS add-on?

Maybe this question is more about Google Service....

Anyone familiar please kindly help, thank you! 

Labels (3)
0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

Yes, this is possible. I can add the filter, but it will be 1to1, so 1 input per user to monitor. If you have 100s of users to monitor, that will become cumbersome to manage.

Did you have an idea on how multiple users would be configured in the UI?

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...