Getting Data In

Why using suppress_text=1 for Windows events logs results in loss of many interesting fields?

aferchichi
New Member

We have installed a universal forwarder on a DC. In order to reduce the size of the windows logs indexed, we have used the option suppress_text=1 under [WinEvenLog://Security] section in the inputs.conf file on the splunk universal forwarder. However, after setting this option, it happens that many interesting fields have disappeared like the Account_Name, Account_Domain, Logon_Type, etc.
So I have the following questions:
- Are all these fields extracted from the message part?
- What exactly contains the message part?
- What remains exactly when suppress_text=1 option is set?

Thanks for your help

0 Karma
1 Solution

Ayn
Legend

You're correct. Many (I would even say most) interesting fields go away when you take away the Message field contents, which is what suppress_text does. To answer what exactly the Message part contains is next to impossible because it depends so much on each event ID what is logged. It's easier to look at it from the other angle of what IS logged apart from the Message field. In Windows Event Viewer terms, "Message" is the stuff you see in the big text box for each event in the Event Viewer. The rest of the fields are what you see below.

View solution in original post

Ayn
Legend

You're correct. Many (I would even say most) interesting fields go away when you take away the Message field contents, which is what suppress_text does. To answer what exactly the Message part contains is next to impossible because it depends so much on each event ID what is logged. It's easier to look at it from the other angle of what IS logged apart from the Message field. In Windows Event Viewer terms, "Message" is the stuff you see in the big text box for each event in the Event Viewer. The rest of the fields are what you see below.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...