https://community.splunk.com/t5/Getting-Data-In/What-are-Wineventlog-overload-limiting-best-practices/m-p/623033#M107223 <P>You can filter which events you ingest by blacklisting and whitelisting specific eventIDs and other fields. That's the only thing I can think of. You can't ingest events and not count them against the license <span class="lia-unicode-emoji" title=":winking_face:">😉</span></P><P>You could try to cut some parts from the events so you only capture most significant fields but that can get messy, unreliable and unmaintainable.</P> Fri, 02 Dec 2022 14:48:19 GMT PickleRick 2022-12-02T14:48:19Z https://community.splunk.com/t5/Getting-Data-In/What-are-Wineventlog-overload-limiting-best-practices/m-p/623030#M107222 <P>We've got Splunk_TA_Windows installed on a number of our servers sending data to our Splunk Cloud instance. However, there is far too much WinEventLog data being sent, pushing us to the limits of our ingest volume.</P> <P>What are best practices to lower this volume. I've already updated the props.conf file with the recommendations from the app installation and we've made adjustments to winnetmon to lower that volume.</P> <P>Are there any other best practices out there? We don't want to just disable it entirely.</P> Fri, 02 Dec 2022 15:33:25 GMT https://community.splunk.com/t5/Getting-Data-In/What-are-Wineventlog-overload-limiting-best-practices/m-p/623030#M107222 paulgo 2022-12-02T15:33:25Z https://community.splunk.com/t5/Getting-Data-In/What-are-Wineventlog-overload-limiting-best-practices/m-p/623033#M107223 <P>You can filter which events you ingest by blacklisting and whitelisting specific eventIDs and other fields. That's the only thing I can think of. You can't ingest events and not count them against the license <span class="lia-unicode-emoji" title=":winking_face:">😉</span></P><P>You could try to cut some parts from the events so you only capture most significant fields but that can get messy, unreliable and unmaintainable.</P> Fri, 02 Dec 2022 14:48:19 GMT https://community.splunk.com/t5/Getting-Data-In/What-are-Wineventlog-overload-limiting-best-practices/m-p/623033#M107223 PickleRick 2022-12-02T14:48:19Z