topic Re: How to capture all entries in Windows Security Logs at first run in Getting Data In https://community.splunk.com/t5/Getting-Data-In/How-to-capture-all-entries-in-Windows-Security-Logs-at-first-run/m-p/69258#M14036 <P>All looks fine. make sure that your wineventslog were present.</P> Thu, 20 Jun 2013 02:37:33 GMT yannK 2013-06-20T02:37:33Z How to capture all entries in Windows Security Logs at first run https://community.splunk.com/t5/Getting-Data-In/How-to-capture-all-entries-in-Windows-Security-Logs-at-first-run/m-p/69257#M14035 <P>hi All,<BR /><BR /> I've setup a heavy forwarder on Server B, and forward the entries in Windows Security log to Server A (Indexer).<BR /><BR /> I configured the inputs.conf on Server B, let say at 9 AM in the morning, the entries are forwarded and indexed successfully. However, seems like it is only captures data from 9 AM onward and not including older entries.</P> <P>The content of inputs.conf:</P> <P>[default]<BR /><BR /> host = hostname.com</P> <P>[WinEventLog:Security]<BR /><BR /> disabled = 0<BR /><BR /> index = security_index<BR /><BR /> current_only = 0<BR /><BR /> start_from = oldest</P> <P>Am I missing something here? </P> <P>Thank you</P> Thu, 20 Jun 2013 01:28:48 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-capture-all-entries-in-Windows-Security-Logs-at-first-run/m-p/69257#M14035 nswcowboy 2013-06-20T01:28:48Z Re: How to capture all entries in Windows Security Logs at first run https://community.splunk.com/t5/Getting-Data-In/How-to-capture-all-entries-in-Windows-Security-Logs-at-first-run/m-p/69258#M14036 <P>All looks fine. make sure that your wineventslog were present.</P> Thu, 20 Jun 2013 02:37:33 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-capture-all-entries-in-Windows-Security-Logs-at-first-run/m-p/69258#M14036 yannK 2013-06-20T02:37:33Z Re: How to capture all entries in Windows Security Logs at first run https://community.splunk.com/t5/Getting-Data-In/How-to-capture-all-entries-in-Windows-Security-Logs-at-first-run/m-p/69259#M14037 <P>the Logs were there and I could see the entries way back before the creation of the input.conf file.<BR /> So, I can't figure out why it only pick up entries after 9 AM.</P> Thu, 20 Jun 2013 03:25:03 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-capture-all-entries-in-Windows-Security-Logs-at-first-run/m-p/69259#M14037 nswcowboy 2013-06-20T03:25:03Z Re: How to capture all entries in Windows Security Logs at first run https://community.splunk.com/t5/Getting-Data-In/How-to-capture-all-entries-in-Windows-Security-Logs-at-first-run/m-p/69260#M14038 <P>Did you figure this out? The exact same thing is happening to me.</P> Tue, 25 Jun 2013 15:03:15 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-capture-all-entries-in-Windows-Security-Logs-at-first-run/m-p/69260#M14038 kmcconnell 2013-06-25T15:03:15Z