Solved: What are the best configuration available to impro...

hrawat · ‎05-03-2023

What are the best configuration available to improve EPS for windows events?

hrawat · ‎05-03-2023

evt_resolve_ad_obj = 1
suppress_checkpoint=true
checkpointInterval = 600
evt_ad_cache_max_entries = 100000
evt_ad_cache_exp = 72000 
evt_ad_cache_exp_neg = 72000
use_old_eventlog_api = true
batch_size = 200
evt_sid_cache_exp = 72000
evt_sid_cache_exp_neg = 72000
evt_sid_cache_max_entries = 40000

View solution in original post

hrawat · ‎05-03-2023

evt_resolve_ad_obj = 1
suppress_checkpoint=true
checkpointInterval = 600
evt_ad_cache_max_entries = 100000
evt_ad_cache_exp = 72000 
evt_ad_cache_exp_neg = 72000
use_old_eventlog_api = true
batch_size = 200
evt_sid_cache_exp = 72000
evt_sid_cache_exp_neg = 72000
evt_sid_cache_max_entries = 40000

What are the best configuration available to improve EPS for windows events?

universal forwarder

Windows

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

Splunk Community Badges!

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

Join the Conversation

What are the best configuration available to improve EPS for windows events?

universal forwarder

Windows

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

Splunk Community Badges!

[Puzzles] Solve, Learn, Repeat: Matching cron expressions