How to integrate ADManager Plus with Splunk and syslog servers

ADManager Plus' integration with Splunk and Syslog servers enables organizations to forward logs of all Active Directory, Microsoft 365, and Google Workspace management actions performed in ADManager Plus.

Steps to integrate ADManager Plus with Splunk

1. Log in to ADManager Plus.
2. Navigate to the Admin tab.
3. Under System Settings, click Integrations.
4. Under Log Forwarding, click Splunk.
5. Configure the following:
   • Splunk Server: Enter the Splunk server name.
   • HTTP Event Collector Port: Enter the port number used by the HTTP Event Collector.
   • Authentication Token: Enter the HTTP Event Collector authentication token. Ensure that in the Splunk Event Collector settings, the Default Source Type is log4j and the Default Index is history. Click here to learn how to create an Event Collector token in your Splunk server.
   • SSL Enabled: Select Yes or No based on whether SSL is enabled or not in your Splunk server. If you select Yes, then specify the path at which the certificate is located in the Root CA Certificate Path field.
6. Click Save.

   

Steps to integrate ADManager Plus with syslog servers

1. Log in to ADManager Plus.
2. Navigate to the Admin tab.
3. Under System Settings, click Integrations.
4. Under Log Forwarding, click Syslog.
5. Configure the fields with the respective values:
   • Syslog Server: Enter the syslog server name.
   • Port: Enter the port number.
   • Protocol: Choose the appropriate protocol, TCP or UDP, for forwarding logs.
   • Syslog Standard: Select the desired syslog message format, RFC 3164, RFC 5424, or RawLog.
   • Data Format: Enter the data format. Sample data can be seen below this field.
6. Click Save to save the configuration.