Knowledge Management

We've been having issues with our DC's sending to much information across to Splunk.

New Member

We are currently pulling windows security events from multiple Windows domain controllers and received issues with the amount events indexed which constantly violates or license.
We have windows logon events (event code: 4624) that capture both user information logons as well as machine logons. There are so many of these logon events that we dont need and would like to remove it in order to stay within the license limit.
The security events also have a large description included in the event under the event type "Message" that would like to be removed.

Tags (1)
0 Karma


You can remove unwanted event log entries by setting a blacklist on the inputs. Here is some documentation that describes how to do this: Monitor Windows event log data - the section that you need is "Use inputs.conf to configure event log monitoring." Look for the whitelist and blacklist settings.

Also, here is a blog post that also discusses using the blacklist to filter events: Windows Event Logs in Splunk 6

Finally, note that this technique only works for Windows event logs. If you want a more general way to eliminate data from being indexed in Splunk, you can use transforms at parsing time - but that's a different question!

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...