All Apps and Add-ons

Windows infrastucture App to Much DATA!

marcusmartin
Path Finder

Good Morning, after finally getting the Windows infrastructure app to produce information i now have a new issue and that is that it is ingesting far to much data so much so that it is going over my license. Over the weekend it ingested quite a bit and i need to get it trimmed down quick smart. Before we only used to monitor logon and logoffs and some group policy changes.  

marcusmartin_0-1604305040501.png

Does anyone have a trimmed down to bare bones input.conf for the app please. i went through it and disabled what i dont want but im not sure its working. also i read somewhere that this app doesnt need to be on all the domain controllers, is that right?

Labels (1)
Tags (1)
0 Karma

marcusmartin
Path Finder

We only have a 7GB license so as you can imagin in 2 days we wont be able to search as the hard limit will have been hit

0 Karma
Get Updates on the Splunk Community!

New Case Study: How LSU’s Student-Powered SOCs and Splunk Are Shaping the Future of ...

Louisiana State University (LSU) is shaping the next generation of cybersecurity professionals through its ...

Splunk and Fraud

Join us on November 13 at 11 am PT / 2 pm ET!Join us for an insightful webinar where we delve into the ...

Build Your First SPL2 App!

Watch the recording now!.Do you want to SPL™, too? SPL2, Splunk's next-generation data search and preparation ...