Splunk Add-on for Microsoft Windows: Why is the winnetmon sourcetype is killing our license with 15-20 GB per day??

[manderson7]

Our 4 production web servers are running windows server 2008 r2, and connect to the primary database in the backend. I installed the Windows TA on them on 6/1, and starting on 6/20 ago, winnetmon has gone crazy, and is sending us at least 15-20G per day. Nothing has changed on the boxes that I know of. What does winnetmon correlate to in Windows that I can check to see what might be causing this?

[jcoates_splunk]

Hi, WinNetMon is the Microsoft world's equivalent of NetFlow or even tcpdump... it makes a lot of data.