https://community.splunk.com/t5/Getting-Data-In/Windows-Event-Logs-amp-Sysmon/m-p/517943#M87604 <P>One change you can make without missing anything is to remove the "boilerplate" that is attached to every Windows event.&nbsp; Use <FONT face="courier new,courier">SEDCMD</FONT> in props.conf to remove the text beginning with "This event is generated...".</P> Fri, 04 Sep 2020 17:25:51 GMT richgalloway 2020-09-04T17:25:51Z https://community.splunk.com/t5/Getting-Data-In/Windows-Event-Logs-amp-Sysmon/m-p/517936#M87603 <P>What's everyone doing for collecting both Windows Event Logs &amp; Sysmon?</P><P>Are you collecting all Even IDs or only a small subset?</P><P>What Sysmon config are you using? Have you tuned it to your environment or just using something like SwiftOnSecurity's Sysmon config?</P><P>&nbsp;</P><P>I ask because our Windows license has grown from ~120G to ~250G and I need to reduce our license but don't want to miss anything.</P> Fri, 04 Sep 2020 16:12:40 GMT https://community.splunk.com/t5/Getting-Data-In/Windows-Event-Logs-amp-Sysmon/m-p/517936#M87603 wgawhh5hbnht 2020-09-04T16:12:40Z https://community.splunk.com/t5/Getting-Data-In/Windows-Event-Logs-amp-Sysmon/m-p/517943#M87604 <P>One change you can make without missing anything is to remove the "boilerplate" that is attached to every Windows event.&nbsp; Use <FONT face="courier new,courier">SEDCMD</FONT> in props.conf to remove the text beginning with "This event is generated...".</P> Fri, 04 Sep 2020 17:25:51 GMT https://community.splunk.com/t5/Getting-Data-In/Windows-Event-Logs-amp-Sysmon/m-p/517943#M87604 richgalloway 2020-09-04T17:25:51Z