General AV Exclusions on Windows Servers with Splunk

[MSTM]

Hello all,

I was hoping that someone might know where I can find the AV scan exclusions I would need to have AV on the same server as Splunk. In particular, I'm looking for the file, folder, process, and service exclusions that should be made in order to Splunk without issue.

[jaxjohnny2000]

Both davbrooking and richgalloway are correct.

https://docs.splunk.com/Documentation/Splunk/7.2.3/ReleaseNotes/RunningSplunkalongsideWindowsantivir...

[davebrooking]

The Release notes for the Enterprise version contains details of recommended AV exclusions

Dave

[richgalloway]

Splunk advises excluding all of $SPLUNK_HOME and $SPLUNK_DB from AV scans.