Knowledge Management

We've been having issues with our DC's sending to much information across to Splunk.

rushmere
New Member

We are currently pulling windows security events from multiple Windows domain controllers and received issues with the amount events indexed which constantly violates or license.
We have windows logon events (event code: 4624) that capture both user information logons as well as machine logons. There are so many of these logon events that we dont need and would like to remove it in order to stay within the license limit.
The security events also have a large description included in the event under the event type "Message" that would like to be removed.

Tags (1)
0 Karma

lguinn2
Legend

You can remove unwanted event log entries by setting a blacklist on the inputs. Here is some documentation that describes how to do this: Monitor Windows event log data - the section that you need is "Use inputs.conf to configure event log monitoring." Look for the whitelist and blacklist settings.

Also, here is a blog post that also discusses using the blacklist to filter events: Windows Event Logs in Splunk 6

Finally, note that this technique only works for Windows event logs. If you want a more general way to eliminate data from being indexed in Splunk, you can use transforms at parsing time - but that's a different question!

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...