https://community.splunk.com/t5/Getting-Data-In/WMI-WinEventLog-Security-make-it-stop/m-p/27462#M4626 <P>Hey all,</P> <P>How do I turn off the local windows splunk server from logging:</P> <PRE><CODE>S-SPLUNK.domain.com WMI:WinEventLog:Security 40653200 </CODE></PRE> <P>This is a copy of the index size it's used in 24 hours, which is 40M. -- significant. I want to disable it. Nothing seems to. I've removed the local monitoring, remote monitoring, etc.</P> <P>Something else is keeping this active that I cannot see in the GUI, I believe.</P> Tue, 14 Jun 2011 18:26:48 GMT jgauthier 2011-06-14T18:26:48Z https://community.splunk.com/t5/Getting-Data-In/WMI-WinEventLog-Security-make-it-stop/m-p/27462#M4626 <P>Hey all,</P> <P>How do I turn off the local windows splunk server from logging:</P> <PRE><CODE>S-SPLUNK.domain.com WMI:WinEventLog:Security 40653200 </CODE></PRE> <P>This is a copy of the index size it's used in 24 hours, which is 40M. -- significant. I want to disable it. Nothing seems to. I've removed the local monitoring, remote monitoring, etc.</P> <P>Something else is keeping this active that I cannot see in the GUI, I believe.</P> Tue, 14 Jun 2011 18:26:48 GMT https://community.splunk.com/t5/Getting-Data-In/WMI-WinEventLog-Security-make-it-stop/m-p/27462#M4626 jgauthier 2011-06-14T18:26:48Z https://community.splunk.com/t5/Getting-Data-In/WMI-WinEventLog-Security-make-it-stop/m-p/27463#M4627 <P>do you have a wmi.conf somewhere in splunk ? if yes just rename it wmi.conf.old</P> Wed, 15 Jun 2011 10:04:44 GMT https://community.splunk.com/t5/Getting-Data-In/WMI-WinEventLog-Security-make-it-stop/m-p/27463#M4627 MarioM 2011-06-15T10:04:44Z