turn off splunk active directory

Hi,

I have splunk on a stand alone webserver that is not using AD and just have the basic server logs and intrusion logs being forwarded.

What I am seeing though is the windows security audit log is getting a great deal of ad monitor events where the service elevates the command and then stops it every minute.

Is there some way to just turn this off completely so it doesn't bloat up my security audit log?

activedirectory

asked 14 Dec '10, 18:34

WePayOnlineJon
1●1●4
accept rate: 0%

One Answer:

oldest newest most voted

You probably want to send those events to the nullQueue. Take a look at the this url and follow the example:

http://www.splunk.com/base/Documentation/4.1.6/Admin/Routeandfilterdata

link

answered 14 Dec '10, 19:20

jbsplunk ♦
10.7k●1●6●25
accept rate: 49%

wow, thanks for the quick response! i will read up on the null queue now!

(14 Dec '10, 20:08) WePayOnlineJon

Post your answer

toggle preview

Follow this question

Email:

RSS:

Answers

Answers + Comments

Markdown Basics

*italic* or _italic_
**bold** or __bold__
link:[text](http://url.com/ "Title")
image?![alt text](/path/img.jpg "Title")
numbered list: 1. Foo 2. Bar
to add a line break simply add two spaces to where you would like the new line to be.
basic HTML tags are also supported

learn more about Markdown

Tags:

activedirectory ×75

Asked: 14 Dec '10, 18:34

Seen: 1,105 times

Last updated: 09 Apr '11, 19:22

turn off splunk active directory

Follow this question

Splunk Resources

Related questions