All Apps and Add-ons

window security log daily log volume does not match actual log volume on server

Communicator

window security log daily log volume doesn't match actual log volume on server. Splunk seems to be using more than the actual .evt files on the system.

For example in my systems actual size of the file C:\Windows\System32\winevt\Logs\Security.evtx is 20480Kb, when splunk indexes it licence volume usage is about 33907KB

Is this expected?

Splunk Employee
Splunk Employee

Evtx file contain only parametrized event data (essentially the same information contained in “details” tab of windows event viewer). Splunk input creates a full events text by using event template (which contains the text of the event with parameters) and this parametrized data.

On Windows Event template is the same for all events with the same id, thus windows avoids coping the same information into evtx file. On the other hand Splunk however expand the event to its full form before sending it to Splunk and that cause the Splunk licensing volume to be higher than actual size.

Now Splunk is working to address such concerns by adding new capability in upcoming release 6.2 where it's expected to have XML mode for the windows events which will only forward certain fields of parametrized data into Splunk. If this option is used the size of the log in Splunk will be no more or even less than windows event log size.