I am new to Splunk and have just installed a trial-licensed installation. I have configured Splunk to receive the event-logs from a small number of Windows-servers, but already now the indexed volume is more than the licensed 500MB. I would also like to collect data from Exchange-servers, Linux-servers and network-equipment, but then the volume would be far too high.
So my question is: Can anybody give me some recommendations of what data and logs I should collect from my servers and boxes to get useful information from the system?
maybe you have to ask yourself, 'what do you want to know or find out?' then you can figure out which logs must be indexed.
for example: are you after login failures, then you have to index the log with the failed logins. would you like to check to what inet page the users go, then index the proxy logs. get it?
there is no masterplan to index data, it depands on your use case.