All Apps and Add-ons

Windows infrastucture App to Much DATA!

marcusmartin
Path Finder

Good Morning, after finally getting the Windows infrastructure app to produce information i now have a new issue and that is that it is ingesting far to much data so much so that it is going over my license. Over the weekend it ingested quite a bit and i need to get it trimmed down quick smart. Before we only used to monitor logon and logoffs and some group policy changes.  

marcusmartin_0-1604305040501.png

Does anyone have a trimmed down to bare bones input.conf for the app please. i went through it and disabled what i dont want but im not sure its working. also i read somewhere that this app doesnt need to be on all the domain controllers, is that right?

Labels (1)
Tags (1)
0 Karma

marcusmartin
Path Finder

We only have a 7GB license so as you can imagin in 2 days we wont be able to search as the hard limit will have been hit

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...