Splunk Search

Splunkd is filling the Security eventlog with Process creation messages

New Member

New Splunk user here:

We have an auditing requirement to audit process creation messages. It appears that the splunk service (Splunkd.exe) is
generating Process creation messages ( Eventid 4688 ) constantly in our security eventlog and the eventlogs are getting huge.

We are using version 6.1.

There must be others out there with this requirement. Are there any work arounds other than disabling auditing.. (which may not be possible)?

Tags (2)
0 Karma


Bump! We're seeing the same issue as well, anyone have an update on this?

0 Karma
Get Updates on the Splunk Community!

Index This | Why do they call it hyper text?

November 2023 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

State of Splunk Careers 2023: Career Resilience and the Continued Value of Splunk

For the past three years, Splunk has partnered with Enterprise Strategy Group to conduct a survey that gauges ...

The Great Resilience Quest: 9th Leaderboard Update

The ninth leaderboard update (11.9-11.22) for The Great Resilience Quest is out >> Kudos to all the ...