Splunk Search

Limit WMI Input

jumper4000
Explorer

We pull in all the security event logs using WMI. However, it's pulling in WAY too much data. Is there a way to limit what gets pulled into Splunk? For example, to only pull in certain Event IDs?

Tags (3)
0 Karma
1 Solution

sdaniels
Splunk Employee
Splunk Employee

Based on a regex you could send unwanted data to the the nullqueue. See link below. That might help reduce the amount of data that you are searching on.

http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Routeandfilterdatad#Filter_event_data_and_...

View solution in original post

sdaniels
Splunk Employee
Splunk Employee

Based on a regex you could send unwanted data to the the nullqueue. See link below. That might help reduce the amount of data that you are searching on.

http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Routeandfilterdatad#Filter_event_data_and_...

Get Updates on the Splunk Community!

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...

From Alert to Resolution: How Splunk Observability Helps SREs Navigate Critical ...

It's 3:17 AM, and your phone buzzes with an urgent alert. Wire transfer processing times have spiked, and ...