What is the best way to ensure that I am not getting a lot of ancillary data not needed for Security dash boarding?

[Ted1621]

I followed Microsoft’s recommendations for security events for domain joined computers.  My window server logs are massive now over 26GB.  We are using heavy forwarders to get the data to Splunk.  What is the best way to ensure that I am not getting a lot of ancillary data not needed for Security dash boarding?  Is there a sample input.conf that will filter only for security events?

[gcusello]

Hi @Ted1621,

at first, when you say Heavy Forwarder, do you mean a full Splunk installation or a Universal Forwarder?

To take logs from a Domain Controlle you need a Universal Forwarder that's very less invasive for the server.

Then, I suppose that you're using the Splunk_TA_Windows to take the DC logs (https://splunkbase.splunk.com/app/742).

In this case, you can enable only the wineventlog:security logs, or at least disabling the performance logs that are very verbose.

Then, you could analize your logs and identify some verbose EventCode that's not useful for Security target and blacklist it, for more infos sse at https://docs.splunk.com/Documentation/Splunk/9.0.1/Admin/Inputsconf. 

When you do this remember to copy the inputs.conf from the default folder to the local folder.

Ciao.

Giuseppe