I am trying to use an Universal Forwarder to access Active Directory and I only want certain User information (displayName, samAccountName and email). How can I limit which data the Universal Forwarder will send to my Splunk Enterprise server?
↧