topic Re: Data could not be written: in Getting Data In

Data could not be written:

bogdan_nicolesc — Mon, 27 Dec 2021 10:59:22 GMT

I have searched high and low for an answer here and on web, but seems that i can't find a suitable answer.

Did anyone got this error while tring to get data in?

Data could not be written: /nobody/search/inputs/WinEventLog://System/start_from: oldest

I played a bit with System log of windows and at first i used the "Local event log collection" but then changed my mind and changed it to "Remote event log collections".

But yet again, first time, using "Local event log collection" i got older data too, second time using "Remote event log collections" i get only newer data.

What can i do to reset it? In what file should i look?

Thank you.

Re: Data could not be written:

scelikok — Mon, 27 Dec 2021 11:07:59 GMT

Hi @bogdan_nicolesc,

In order to reset the checkpoint you should delete below file on Windows host and restart Universal Forwarder service.

C:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\System

Re: Data could not be written:

bogdan_nicolesc — Mon, 27 Dec 2021 11:23:24 GMT

Did all that and i get the same error.

Re: Data could not be written:

bogdan_nicolesc — Mon, 27 Dec 2021 11:25:43 GMT

Would a pc reboot would do?