Splunk Enterprise Security

SPLUNK_HOME/var/lib/splunk/modinputs taking up disk space

navarec
Explorer

Hi All,
The data checkpoint file for windows logs is taking up a lot of disk space (over 100 GB).
Where can I check the modular input script. We are having issues of full disk space due to this.

How can I exclude the modinput for one of the checkpoint on particular servers?

An example windows log event is as following:

\powershell.exe (CLI interpreter), Pid: 12345,\OSEvent: (Source: (Uid: xxxxxxxxx, Name: splunk-winevtlog.exe, Pid: 123123, Session Id: 0, Executable Target: Path: \Device\HarddiskVolume4\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Application)

Any help would be appreciated!

Thanks in Advance!

Labels (1)
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...