Hello Splunk Community! I currently have Splunk App for Windows Infrastructure configured and deployed to several Universal Forwarders. Most of this is working good, and I am working out some things with it but before I go much further I am trying to find out how to cut back on the amount of process related data I am ingesting.  In 3 short months my windows index is almost 500gb in size! Briefly looking into the index I can see that a massive amount of events are related to the process category, and while we're interested in seeing process related data, its definitely not our top concern and this data seems to be dominating the index.  Does anyone have suggestions for how I could cut this back?  ... View more