Getting Data In

Is there a best practice guide for Splunk and Windows Event Collectors?

itrimble1
Path Finder

Does anyone have a guide for load balancing among Windows Event Collectors?

We have about 8 Windows Event Collector Servers.

We want to know if there is a best practice guide to get this set up correctly in Splunk, or any other SIEM.

We appear to be experiencing latency from the time the event is transmitted from the UF -----> HF.........>IDX.

0 Karma

itrimble1
Path Finder

I thought I'd answer this post, since I've learned a lot in between the original question and now. These resources really helped me out. I hope they can do the same for you.

Monitoring What Matters - Jessica Payne (Microsoft)
Peeping Through WIndows (Logs) - Hunting With Splunk - Part 5
Integrating Splunk with native Windows Event Collection - Great Webinar from Ultimate Windows Security
To XML or Classic Format - Conclusion is that XML collection is slower than classic rendering
Windows Event Forwarding Guidance - Guide to help setting up central Windows Logging through a collector
Project Sauron - Centralized Storage of Windows Events (Microsoft)
Create and Manage Subscriptions with PowerShell
Best Practice for Configuring EventLog Forwarding - specifically Server 2012R2, Server 2016
Blacklists and Whitelist Tuning - Hurricane Labs - Great guide to save on licensing

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...