Splunk Search

Huge logs not getting stopped

udayk1
Path Finder

We have one server which sends many logs say per hour 4000 logs which are not required i.e. event ID of 560 and 562. As we don't want these logs we have disabled the auditing in the respective server, since it was of no luck we were still receiving the logs.
Post which we disabled and uninstalled Splunk Forwarder, uninstalled the respective software which sends logs to Splunk and also we are seeing huge logs of that particular server. Anywhere else we need to disable?

Tags (1)
0 Karma
1 Solution

udayk1
Path Finder

This has been solved.

View solution in original post

0 Karma

splunker12er
Motivator

Not at all possible. when a software doesnt exit/uninstalled how can it do its job ?!

0 Karma

udayk1
Path Finder

This has been solved.

0 Karma

davidpaper
Contributor

What was the solution?

0 Karma

Ayn
Legend

Do you mean that you're still seeing new events from this server despite that you have inactivated these events and also uninstalled the forwarder there? That seems...highly unlikely unless you did something seriously wrong...

0 Karma

udayk1
Path Finder

Sorry it is not 4000 per hour, it is per minute

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...