topic Re: turn off splunk active directory in Getting Data In

turn off splunk active directory

WePayOnlineJon — Wed, 15 Dec 2010 02:34:55 GMT

Hi,

I have splunk on a stand alone webserver that is not using AD and just have the basic server logs and intrusion logs being forwarded.

What I am seeing though is the windows security audit log is getting a great deal of ad monitor events where the service elevates the command and then stops it every minute.

Is there some way to just turn this off completely so it doesn't bloat up my security audit log?

Re: turn off splunk active directory

jbsplunk — Wed, 15 Dec 2010 03:20:20 GMT

You probably want to send those events to the nullQueue. Take a look at the this url and follow the example:

http://www.splunk.com/base/Documentation/4.1.6/Admin/Routeandfilterdata

Re: turn off splunk active directory

WePayOnlineJon — Wed, 15 Dec 2010 04:08:09 GMT

wow, thanks for the quick response! i will read up on the null queue now!