Hello.
Good afternoon. Looking for some best practices here. Over the years, we have been using the UF to ingest Windows data. This is a reliable solution for ensuring the Windows events are being ingested into Splunk indexes. We now have a new solution called Crowdstrike which seems to also ingest Windows events as well. Based on the experience from the Splunk Community, can anyone share their experiences (or best practices)? We would like to have a reliable Windows solution but refrain from having duplicate data.
Regards,
Max
