Good morning. We have been tracking a recent reduction in our log ingest rate. After a myriad of searching, it appears that the reduction in xml Win Event Logs occurred the same week that windows patching occurred in July of 2022. We are down by approximately 10%, maybe a little less than that. We have noted that the xml wineventlogs appears to be the only index affected. I'm concerned because this could indicate: Patching broke logging on the windows systems and we aren't getting everything we used to or should Patching made logging more efficient and we are getting the same or better/more data with less overall size Something else could be broken within Splunk itself and this is the only indication We opened an on-demand case and they found nothing wrong. We opened a support case and they told us what we could see for ourselves in the cloud monitoring console. We've continued to search and investigate, and our working theory is that patching affected the logging. We now need to know if it's a good thing (number 2) or a bad thing (number 1). My question is - has anyone else noticed a drop in xmlwineventlog volume over the last few months? Thanks in advance. ... View more