Getting Data In

Windows Event Logs and Splunk-Can Splunk be configured to delete event logs?

sysadmin74
New Member

Is there any capability within Splunk so it automatically deletes the Application, Security, and System Logs in Event Viewer after Splunk receives the events? We currently have Windows Server 2003 R2 but also looking to implement Windows Server 2008 R2. Specifically, I'm curious as to if there are any configuration options available in Splunk to delete the logs in Event Viewer after Splunk gets the data from these logs. We're looking for an alternative to creating a Group Policy Object that will overwrite the logs. Thanks in advance to anyone willing to provide input

0 Karma
1 Solution

kdenton
Path Finder

No, not built in.

Your best bet is a Group Policy that sets the server logs to Overwrite as needed.

View solution in original post

Ayn
Legend

In addition to the previous answer that is completely right, is there a specific reason for you to want to delete or overwrite logs? By default Windows is configured to throw old events FIFO style when the log grows to a certain size (I believe 16MB is the default, or at least used to be). You could lower this limit substantially if you're running a Universal Forwarder on the host since the forwarder will be picking up events immediately as they arrive anyway. That way the logs will be overwritten pretty soon in order to make room for new logs arriving in the event log.

aelliott
Motivator

is there any implications that could happen if it were set to overwrite and current_only set to 1?

0 Karma

kdenton
Path Finder

No, not built in.

Your best bet is a Group Policy that sets the server logs to Overwrite as needed.

Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...