https://community.splunk.com/t5/Installation/Domain-Controller-computer-logons/m-p/451014#M5880 <P>I'm currently dealing with an environment with a number of domain controllers that will need to begin forwarding Windows event logs into Splunk. A worry is license threshold.</P> <P>I've whitelisted only the event codes we are interested in, but this has done little as 4624/4634, account logons/logoffs, have a lot of noise with network logons. I've toyed with blacklisting any logon using a computer's sAMAccountName$. This drops off our license usage per DC immensely, but I'm worried that we might be missing some valuable event data.</P> <P>Does anyone have any insight to if this is a good/bad practice, what types of info we'd be missing out on, and/or any alternative suggestions to minimizing the load that DC's place on license usage?</P> Mon, 15 Jun 2020 19:03:19 GMT wilcompl1334 2020-06-15T19:03:19Z https://community.splunk.com/t5/Installation/Domain-Controller-computer-logons/m-p/451014#M5880 <P>I'm currently dealing with an environment with a number of domain controllers that will need to begin forwarding Windows event logs into Splunk. A worry is license threshold.</P> <P>I've whitelisted only the event codes we are interested in, but this has done little as 4624/4634, account logons/logoffs, have a lot of noise with network logons. I've toyed with blacklisting any logon using a computer's sAMAccountName$. This drops off our license usage per DC immensely, but I'm worried that we might be missing some valuable event data.</P> <P>Does anyone have any insight to if this is a good/bad practice, what types of info we'd be missing out on, and/or any alternative suggestions to minimizing the load that DC's place on license usage?</P> Mon, 15 Jun 2020 19:03:19 GMT https://community.splunk.com/t5/Installation/Domain-Controller-computer-logons/m-p/451014#M5880 wilcompl1334 2020-06-15T19:03:19Z