turn off splunk active directory

[WePayOnlineJon]

Hi,

I have splunk on a stand alone webserver that is not using AD and just have the basic server logs and intrusion logs being forwarded.

What I am seeing though is the windows security audit log is getting a great deal of ad monitor events where the service elevates the command and then stops it every minute.

Is there some way to just turn this off completely so it doesn't bloat up my security audit log?

[jbsplunk]

You probably want to send those events to the nullQueue. Take a look at the this url and follow the example:

http://www.splunk.com/base/Documentation/4.1.6/Admin/Routeandfilterdata

[WePayOnlineJon]

wow, thanks for the quick response! i will read up on the null queue now!