Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Re: Can you help me figure out why our Windows Dom...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
We have a Windows Domain Controller(DC) that creates lots of security events. We are monitoring wineventlog://security and have noticed that, on a regular basis, we get no events. We know the events are there because we can see events we missed in the evt files that are kept. The OS has a policy to rotate the log when it gets to a certain size, and we are thinking this may be when we stop getting events. This happens on all of our DCs, but not at the same time. Any experience with high volume DCs and logs rolling causing a problem?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@bstimely Assuming you have a high performing IDX at the recipient end, i would perform the following analysis to make the changes
- Check the pipelines at the UF, HF (If there is an intermediate HF) and IDX and see that there is no blocks causing the delay
- If the clogging is in the HF, try to play around maxthrougput and parallelingestionpipelines ; also ensure that the HF performance is very minimal and it is utilizing less than 50% of resources so that there are no overhead when you enable these configurations
- Play around the maxthroughput of UF and see if it allows forwarding of events from the UF faster.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@bstimely Assuming you have a high performing IDX at the recipient end, i would perform the following analysis to make the changes
- Check the pipelines at the UF, HF (If there is an intermediate HF) and IDX and see that there is no blocks causing the delay
- If the clogging is in the HF, try to play around maxthrougput and parallelingestionpipelines ; also ensure that the HF performance is very minimal and it is utilizing less than 50% of resources so that there are no overhead when you enable these configurations
- Play around the maxthroughput of UF and see if it allows forwarding of events from the UF faster.
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas
What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)
Automating Threat Operations and Threat Hunting with Recorded Future
