What are Wineventlog overload/limiting best practices?

[paulgo]

We've got Splunk_TA_Windows installed on a number of our servers sending data to our Splunk Cloud instance. However, there is far too much WinEventLog data being sent, pushing us to the limits of our ingest volume.

What are best practices to lower this volume. I've already updated the props.conf file with the recommendations from the app installation and we've made adjustments to winnetmon to lower that volume.

Are there any other best practices out there? We don't want to just disable it entirely.

[PickleRick · Accepted solution]

You can filter which events you ingest by blacklisting and whitelisting specific eventIDs and other fields. That's the only thing I can think of. You can't ingest events and not count them against the license 😉

You could try to cut some parts from the events so you only capture most significant fields but that can get messy, unreliable and unmaintainable.