Hi All, The data checkpoint file for windows logs is taking up a lot of disk space (over 100 GB). Where can I check the modular input script. We are having issues of full disk space due to this. How can I exclude the modinput for one of the checkpoint on particular servers? An example windows log event is as following: \powershell.exe (CLI interpreter), Pid: 12345,\OSEvent: (Source: (Uid: xxxxxxxxx, Name: splunk-winevtlog.exe, Pid: 123123, Session Id: 0, Executable Target: Path: \Device\HarddiskVolume4\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Application) Any help would be appreciated! Thanks in Advance!
... View more