All Apps and Add-ons

What are the implications of enabling suppress_sourcename in your Windows inputs.conf ?

itrimble1
Path Finder

To improve indexing speed for windows security events on Splunk Heavy Forwarders with Windows Event Collection enabled, we have been told to enable: (on our inputs.conf)
suppress_sourcename
suppress_checkpoint
suppress_keywords
suppress_type
suppress_opcode
use_threads = 7

We did see our indexing speeds improve x 4. From 2Mbps to 7.94Mbps. But once the logs were ingested, indexing rates dropped back down to around 1-2Mbps.

We were also told that we need to set renderxml=true for these suppression stanzas to work. Is this accurate?

The problem with our RenderXML=True is that our fields do not extract correctly. The events also break. We are using the latest TA-Windows app.

Are we losing anything by enabling these (Splunk developer) settings?

Does this just affect search time field extraction?

Is the processing now being done on the indexers as a result?

Update 10/1/2019
We disabled suppression and the latency came back.
We disabled the renderxml=true and it didn't affect speeds.
We solved our fields not extracting at searchtime , by changing our sourcetype for the [WinEventLog://Forwarded Events] input. (with renderxml=true)

1 Solution

dillardo_2
Path Finder

Changed use_threads to use 15 threads. (Made no difference)
Enabled: On the rest of the Windows Event Collectors
suppress_sourcename
suppress_checkpoint
suppress_keywords
suppress_type
suppress_opcode

Note: Splunk recommends not changing these settings without speaking with support first.

This is the result. While we are pleased with this after months. We will evaluate how it affects Enterprise Security.

View solution in original post

0 Karma

dillardo_2
Path Finder

Changed use_threads to use 15 threads. (Made no difference)
Enabled: On the rest of the Windows Event Collectors
suppress_sourcename
suppress_checkpoint
suppress_keywords
suppress_type
suppress_opcode

Note: Splunk recommends not changing these settings without speaking with support first.

This is the result. While we are pleased with this after months. We will evaluate how it affects Enterprise Security.

0 Karma

itrimble1
Path Finder

Update 10/2/2019
Changed use_threads to use 15 threads. (Made no difference)
Enabled: On the rest of the Windows Event Collectors
suppress_sourcename
suppress_checkpoint
suppress_keywords
suppress_type
suppress_opcode

This is the result. While we are pleased with this after months. We will evaluate how it affects Enterprise Security.
alt text

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...