topic Re: Forwarder not pulling in past Window events in Getting Data In

Forwarder not pulling in past Window events

kmcconnell — Mon, 28 Sep 2020 14:10:13 GMT

I'm trying to pull in all the existing events from the Windows logs for a machine (application, security, & system). I thought I had the inputs.conf setup correctly, but it is only pulling in events from the time that I pushed the inputs.conf file out (from the deployment server). Below is the inputs.conf section:

[WinEventLog:Application]
disabled = 0
start_from = oldest
current_only = 0
checkpointInterval = 5
index=emn_investigation

[WinEventLog:Security]
disabled = 0
start_from = oldest
current_only = 0
evt_resolve_ad_obj = 1
checkpointInterval = 5
index=emn_investigation

[WinEventLog:System]
disabled = 0
start_from = oldest
current_only = 0
checkpointInterval = 5
index=emn_investigation

Am I missing a setting? Do I need to remove the current_only = 0 setting? This data is going into a new index so I can delete the data completely if I need to try something else.

Re: Forwarder not pulling in past Window events

okrabbe_splunk — Tue, 25 Jun 2013 20:52:06 GMT

Did you by any chance configure this forwarders inputs multiple times so that it may have been monitoring and so it remembers the former position?

You can clean out the forwarders memory of where it was in the event long by running the command "splunk clean all".

Omid

Re: Forwarder not pulling in past Window events

kmcconnell — Wed, 26 Jun 2013 19:00:13 GMT

I believe the "splunk clean all" would work for my issue, but the forwarder was installed remotely using psexec and I'm unable log into the console. When I try to run "splunk clean all" through psexec it freezes and does not appear to do anything. Do you know where onthe forwarder this information is stored? Seems I could manually wipe the file instead.

Re: Forwarder not pulling in past Window events

okrabbe_splunk — Wed, 26 Jun 2013 20:53:22 GMT

You could try deleting the files in the fishbucket directory located at $SPLUNK_home/var/lib/splunk/fishbucket

Be sure the forwarder is stopped.