# Get the license usage down in Splunk when indexing Bro logs **URL:** \ **Category:** Zeek\ **Created:** [July 11, 2017, 10:48am UTC](https://community.zeek.org/t/get-the-license-usage-down-in-splunk-when-indexing-bro-logs/4938 "2017-07-11T10:48:24Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![SwedishMike](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/swedishmike/32/605_2.png) [@SwedishMike](https://community.zeek.org/u/SwedishMike)\ **Post date:** [July 11, 2017, 10:48am UTC](https://community.zeek.org/t/get-the-license-usage-down-in-splunk-when-indexing-bro-logs/4938/1 "2017-07-11T10:48:24Z")
Hi all, We’re currently working on deploying Bro sensors to various offices and I’ve come to realise that the Bro logs are quite ‘expensive’ when it comes to Splunk licenses. To say the least. We have discussed various solutions but most of them fall down on us losing the ability to correlate events unless we shift all the logs in to Splunk. At the moment we’re running it pretty much ‘out of the box’ so we can save some GB’s per day to turn of certain scripts, but it will probably not be enough. Someone mentioned that turning on JSON logging instead of the standard logging on Bro could save considerable amounts of space on your SIEM. Have any of you guys tested this and can you back that statement up? I was hoping that someone else had encountered this before and had come up with some solution(s) to this issue? Thanks in advance, Mike ---
**Author:** ![Dave\_Crawford](https://avatars.discourse-cdn.com/v4/letter/d/919ad9/32.png) [@Dave\_Crawford](https://community.zeek.org/u/Dave_Crawford)\ **Post date:** [July 11, 2017, 2:57pm UTC](https://community.zeek.org/t/get-the-license-usage-down-in-splunk-when-indexing-bro-logs/4938/2 "2017-07-11T14:57:06Z")
The JSON logs will always be larger than the default tab delimited. With JSON every log event includes the "column" names versus a set of headers in he delimited format. ---
**Author:** ![Slagell\_Adam\_J](https://avatars.discourse-cdn.com/v4/letter/s/e9c0ed/32.png) [@Slagell\_Adam\_J](https://community.zeek.org/u/Slagell_Adam_J)\ **Post date:** [July 11, 2017, 3:03pm UTC](https://community.zeek.org/t/get-the-license-usage-down-in-splunk-when-indexing-bro-logs/4938/3 "2017-07-11T15:03:26Z")
Well if you are collecting net flows and conn.logs, you could get rid of one. If you are recapturing syslogs with Bro and sending them to Splunk, you could trim duplication there. If you are finding a ton of certificate information in your bro logs, you might realize some cost savings there. But I don’t have much advice beyond don’t send the same info twice and look for large amounts of data that you don’t really use in Splunk, like maybe certificates. ---
**Author:** ![Hosom\_Stephen\_M](https://avatars.discourse-cdn.com/v4/letter/h/d26b3c/32.png) [@Hosom\_Stephen\_M](https://community.zeek.org/u/Hosom_Stephen_M)\ **Post date:** [July 11, 2017, 5:41pm UTC](https://community.zeek.org/t/get-the-license-usage-down-in-splunk-when-indexing-bro-logs/4938/4 "2017-07-11T17:41:32Z")
Some people choose to implement Bro log filters that can result in a significant reduction in log volume. For example, if you filter all S0 connections originating from outside of your organization (and you also happen to listen outside of a firewall) this could reduce a substantial amount of log volume. ---
**Author:** ![JonZeolla](https://avatars.discourse-cdn.com/v4/letter/j/ccd318/32.png) [@JonZeolla](https://community.zeek.org/u/JonZeolla)\ **Post date:** [July 11, 2017, 6:06pm UTC](https://community.zeek.org/t/get-the-license-usage-down-in-splunk-when-indexing-bro-logs/4938/5 "2017-07-11T18:06:48Z")
In order to reduce logging load for some of our logging plugins we’ve applied filters that do things like drop S0 connections from conn, only send traffic to/from the Internet, or only send traffic to/from sensitive zones. I have an example of one of our configs [here](https://github.com/JonZeolla/Development/blob/master/bro/logs-to-kafka.bro) (the example also filters out IPv6 in a way that works for pre-2.5 - now there are is\_v{4,6}\_subnet() functions to handle this). Jon ---
**Author:** ![Joshua\_Buysse](https://avatars.discourse-cdn.com/v4/letter/j/da6949/32.png) [@Joshua\_Buysse](https://community.zeek.org/u/Joshua_Buysse)\ **Post date:** [July 11, 2017, 6:55pm UTC](https://community.zeek.org/t/get-the-license-usage-down-in-splunk-when-indexing-bro-logs/4938/6 "2017-07-11T18:55:13Z")
I think I know where Mike’s misunderstanding comes from - the JSON logs are larger original size (for license volume), but will use less space on indexer disk than the default TSV because the extractions are search-time instead of index-time. ---
**Author:** ![Osama\_Elnaggar](https://avatars.discourse-cdn.com/v4/letter/o/ba8739/32.png) [@Osama\_Elnaggar](https://community.zeek.org/u/Osama_Elnaggar)\ **Post date:** [July 11, 2017, 9:55pm UTC](https://community.zeek.org/t/get-the-license-usage-down-in-splunk-when-indexing-bro-logs/4938/7 "2017-07-11T21:55:50Z")
To build on some of the suggestions, you may also want to tier your logging. You can send high value logs which can kick off an investigation to Splunk while sending less valuable logs which will help in investigations but not start them to something like ELK or ELSA / ODE. This will add a little overhead to your operations and involves more moving parts but can significantly reduce your licensing costs. ---
**Author:** ![SwedishMike](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/swedishmike/32/605_2.png) [@SwedishMike](https://community.zeek.org/u/SwedishMike)\ **Post date:** [July 12, 2017, 5:07am UTC](https://community.zeek.org/t/get-the-license-usage-down-in-splunk-when-indexing-bro-logs/4938/8 "2017-07-12T05:07:20Z")
Jon, Many thanks for your reply - that looks really useful. Many thanks for your examples, I’ll have a look at them. Cheers, Mike ---
**Author:** ![SwedishMike](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/swedishmike/32/605_2.png) [@SwedishMike](https://community.zeek.org/u/SwedishMike)\ **Post date:** [July 12, 2017, 5:08am UTC](https://community.zeek.org/t/get-the-license-usage-down-in-splunk-when-indexing-bro-logs/4938/9 "2017-07-12T05:08:20Z")
Joshua, Many thanks for your reply. That’s the one! 😉 It will not make much use for our license usage - but will save space on the disk then. Cheers, Mike ---
**Author:** ![SwedishMike](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/swedishmike/32/605_2.png) [@SwedishMike](https://community.zeek.org/u/SwedishMike)\ **Post date:** [July 12, 2017, 5:09am UTC](https://community.zeek.org/t/get-the-license-usage-down-in-splunk-when-indexing-bro-logs/4938/10 "2017-07-12T05:09:16Z")
Osama, I’m starting to lean towards this as being the next step to look into once I’ve looked at the suggestions from the list. More suggestions are of course very welcome 😉 Cheers, Mike ---
**Author:** ![SwedishMike](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/swedishmike/32/605_2.png) [@SwedishMike](https://community.zeek.org/u/SwedishMike)\ **Post date:** [July 12, 2017, 9:07am UTC](https://community.zeek.org/t/get-the-license-usage-down-in-splunk-when-indexing-bro-logs/4938/11 "2017-07-12T09:07:59Z")
Stephen, I’ve been looking at the various ways of dropping the S0 connections from the outside but haven’t found a simple way of doing this. My Google-Fu seems to have abandoned me, hopefully just temporarily. Would you mind sharing some examples on how you and your organisation implemented this? Cheers, Mike ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:45pm UTC](https://community.zeek.org/t/get-the-license-usage-down-in-splunk-when-indexing-bro-logs/4938/12 "2022-05-06T15:45:07Z")