Getting Data In

Why using suppress_text=1 for Windows events logs results in loss of many interesting fields?

aferchichi
New Member

We have installed a universal forwarder on a DC. In order to reduce the size of the windows logs indexed, we have used the option suppress_text=1 under [WinEvenLog://Security] section in the inputs.conf file on the splunk universal forwarder. However, after setting this option, it happens that many interesting fields have disappeared like the Account_Name, Account_Domain, Logon_Type, etc.
So I have the following questions:
- Are all these fields extracted from the message part?
- What exactly contains the message part?
- What remains exactly when suppress_text=1 option is set?

Thanks for your help

0 Karma
1 Solution

Ayn
Legend

You're correct. Many (I would even say most) interesting fields go away when you take away the Message field contents, which is what suppress_text does. To answer what exactly the Message part contains is next to impossible because it depends so much on each event ID what is logged. It's easier to look at it from the other angle of what IS logged apart from the Message field. In Windows Event Viewer terms, "Message" is the stuff you see in the big text box for each event in the Event Viewer. The rest of the fields are what you see below.

View solution in original post

Ayn
Legend

You're correct. Many (I would even say most) interesting fields go away when you take away the Message field contents, which is what suppress_text does. To answer what exactly the Message part contains is next to impossible because it depends so much on each event ID what is logged. It's easier to look at it from the other angle of what IS logged apart from the Message field. In Windows Event Viewer terms, "Message" is the stuff you see in the big text box for each event in the Event Viewer. The rest of the fields are what you see below.

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...