We've been having issues with our DC's sending to much information across to Splunk.

[rushmere]

We are currently pulling windows security events from multiple Windows domain controllers and received issues with the amount events indexed which constantly violates or license.
We have windows logon events (event code: 4624) that capture both user information logons as well as machine logons. There are so many of these logon events that we dont need and would like to remove it in order to stay within the license limit.
The security events also have a large description included in the event under the event type "Message" that would like to be removed.

[lguinn2]

You can remove unwanted event log entries by setting a blacklist on the inputs. Here is some documentation that describes how to do this: Monitor Windows event log data - the section that you need is "Use inputs.conf to configure event log monitoring." Look for the whitelist and blacklist settings.

Also, here is a blog post that also discusses using the blacklist to filter events: Windows Event Logs in Splunk 6

Finally, note that this technique only works for Windows event logs. If you want a more general way to eliminate data from being indexed in Splunk, you can use transforms at parsing time - but that's a different question!