Knowledge Management

We've been having issues with our DC's sending to much information across to Splunk.

rushmere
New Member

We are currently pulling windows security events from multiple Windows domain controllers and received issues with the amount events indexed which constantly violates or license.
We have windows logon events (event code: 4624) that capture both user information logons as well as machine logons. There are so many of these logon events that we dont need and would like to remove it in order to stay within the license limit.
The security events also have a large description included in the event under the event type "Message" that would like to be removed.

Tags (1)
0 Karma

lguinn2
Legend

You can remove unwanted event log entries by setting a blacklist on the inputs. Here is some documentation that describes how to do this: Monitor Windows event log data - the section that you need is "Use inputs.conf to configure event log monitoring." Look for the whitelist and blacklist settings.

Also, here is a blog post that also discusses using the blacklist to filter events: Windows Event Logs in Splunk 6

Finally, note that this technique only works for Windows event logs. If you want a more general way to eliminate data from being indexed in Splunk, you can use transforms at parsing time - but that's a different question!

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...