splunk

The generic Windows audit log config lacks many event ids, e.g.

• registry events
• driver load service addition events, System/7045 and Security/4697
• likely others

What would you like to be added:

Document experience we have seen with various log rotation size/frequency settings and how rotate_wait or refresh_interval may help.

Why is this needed:

To help users validate the upper limit of a single collector and review some deployment changes that can be made t

In many environments there is a cost to network traffic used. Allowing compression of the HTTP post to the HEC endpoint could greatly reduce these costs and transport time.

Hello,

Running SC4S on baremetal CentOS. It appears to be working fine, but Splunk catchall index is peppered with these errors and I can't figure out why. Service starts up without errors and runs as root. Followed install instructions to a tee.

`2021-07-09T15:43:31.743+00:00 sc4s syslog-ng 18199 - [meta sequenceId="59033"] Error opening file for writing; filename='/dev/stdout', error='N