https://community.splunk.com/t5/Security/Application-events-stops-forwarding/m-p/193765#M5692 <P>This issue got resolved after upgrading the Universal Forwarder to 6.0. Event Process in 6.0 is multi-threaded and that seems to have helped in this case.</P> Tue, 10 Jun 2014 05:40:23 GMT rbal_splunk 2014-06-10T05:40:23Z https://community.splunk.com/t5/Security/Application-events-stops-forwarding/m-p/193764#M5691 <P>We are noticing on an exchange server that gets lots of application events, after a given timeframe it stops forwarding application events, yet it still continues to send System and Security. Restarting the service the application events start to forward again, but then stop after a given timeframe. </P> <P>The particular server is running Universal Forwarder version 5.0.1.<BR /> …/etc/system/local /inputs.conf [WinEventLog:Application]<BR /> .. /etc/system/local/inputs.conf checkpointInterval = 5<BR /> .. /etc/system/local/inputs.conf current_only = 1<BR /> .. /etc/system/local/inputs.conf disabled = 0<BR /> .. /etc/system/local/inputs.conf host = test<BR /> .. /etc/system/default/inputs.conf index = default<BR /> .. /etc/system/local/inputs.conf start_from = oldest</P> Mon, 28 Sep 2020 16:49:32 GMT https://community.splunk.com/t5/Security/Application-events-stops-forwarding/m-p/193764#M5691 rbal_splunk 2020-09-28T16:49:32Z https://community.splunk.com/t5/Security/Application-events-stops-forwarding/m-p/193765#M5692 <P>This issue got resolved after upgrading the Universal Forwarder to 6.0. Event Process in 6.0 is multi-threaded and that seems to have helped in this case.</P> Tue, 10 Jun 2014 05:40:23 GMT https://community.splunk.com/t5/Security/Application-events-stops-forwarding/m-p/193765#M5692 rbal_splunk 2014-06-10T05:40:23Z