How can we restrict computer owners from injecting more data into splunk?. We have around 1000 computers which reports to our splunk cloud through universal forwarders. Initially All the forwarders were configured to send only Application event logs, but now some of the computer owners edit the inputs.conf files themselves on forwarders and try to send the unwanted data’s to splunk which is costing us too much. How can we restrict this kind of activity so that without our permission no one can edit inputs.conf files and send data to splunk through a universal forwarder. Please provide us some suggestions.
↧
