Getting Data In

splunk-optimize.exe WIndows Security Events

jheilman
Explorer

I have a test Windows forwarder set up that is generating over 22,000 events relating to the splunk-optimize.exe process in the Windows Security Event Log. I've temporarily implemented a filter that forwards Event ID 592 and 593 to nullQueue, but ideally we would want to index that data. 22k events per 24 hours per splunk Windows instance seems a bit expensive though.

Is it normal for splunk-optimize to run this often or generate this many events?

Setup Info:

The splunk indexer is set up on a Linux machine. The forwarder is running on Windows 2k3 Server (32-bit) in a virtual machine with two 2.66GHz processors (Intel Xeon) and 1GB of RAM. It's configured as a full forwarder.

1 Solution

gkanapathy
Splunk Employee
Splunk Employee

This is normal. If you're choosing to turn your Windows auditing to record every process launch and termination, then on many server applications you should expect to see many such events. This corresponds to only about one process launch and exit every 7 seconds or so.

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

This is normal. If you're choosing to turn your Windows auditing to record every process launch and termination, then on many server applications you should expect to see many such events. This corresponds to only about one process launch and exit every 7 seconds or so.

Get Updates on the Splunk Community!

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...