What data should I index?

[thoree]

I am new to Splunk and have just installed a trial-licensed installation. I have configured Splunk to receive the event-logs from a small number of Windows-servers, but already now the indexed volume is more than the licensed 500MB. I would also like to collect data from Exchange-servers, Linux-servers and network-equipment, but then the volume would be far too high.

So my question is: Can anybody give me some recommendations of what data and logs I should collect from my servers and boxes to get useful information from the system?

[thoree]

Thanks for your answer. I think my "problem" as a new Splunk-user is that I want to collect "everything" from all devices, but of course this is not possible 🙂

[MuS]

Hi thoree, that is possible but why don't you just limit yourself to one Windows, one Linux and one Network Device instead of everything and all rigth from the start?
regards

[MuS]

Hi thoree

maybe you have to ask yourself, 'what do you want to know or find out?' then you can figure out which logs must be indexed.

for example: are you after login failures, then you have to index the log with the failed logins. would you like to check to what inet page the users go, then index the proxy logs. get it?

there is no masterplan to index data, it depands on your use case.

regards, MuS