Getting Data In

Why using suppress_text=1 for Windows events logs results in loss of many interesting fields?

New Member

We have installed a universal forwarder on a DC. In order to reduce the size of the windows logs indexed, we have used the option suppresstext=1 under [WinEvenLog://Security] section in the inputs.conf file on the splunk universal forwarder. However, after setting this option, it happens that many interesting fields have disappeared like the AccountName, AccountDomain, LogonType, etc.
So I have the following questions:
- Are all these fields extracted from the message part?
- What exactly contains the message part?
- What remains exactly when suppress_text=1 option is set?

Thanks for your help

0 Karma
1 Solution

Legend

You're correct. Many (I would even say most) interesting fields go away when you take away the Message field contents, which is what suppress_text does. To answer what exactly the Message part contains is next to impossible because it depends so much on each event ID what is logged. It's easier to look at it from the other angle of what IS logged apart from the Message field. In Windows Event Viewer terms, "Message" is the stuff you see in the big text box for each event in the Event Viewer. The rest of the fields are what you see below.

View solution in original post

Legend

You're correct. Many (I would even say most) interesting fields go away when you take away the Message field contents, which is what suppress_text does. To answer what exactly the Message part contains is next to impossible because it depends so much on each event ID what is logged. It's easier to look at it from the other angle of what IS logged apart from the Message field. In Windows Event Viewer terms, "Message" is the stuff you see in the big text box for each event in the Event Viewer. The rest of the fields are what you see below.

View solution in original post