topic Re: Universal Forwarder - Start collection without indexing old logs in Getting Data In

Universal Forwarder - Start collection without indexing old logs

zindain24 — Wed, 20 Jun 2012 13:01:52 GMT

Hello, we are looking to collect Windows (Application, Security, and System) logs from 14 Domain Controllers. By default the Universal Forwarder begins indexing the logs from the systems earliest event to the most recent. Is there a way we can tell the forwarder to start collection of new events, and not index the old log files?

Thanks!

Re: Universal Forwarder - Start collection without indexing old logs

ysouchon — Wed, 20 Jun 2012 13:23:02 GMT

Via inputs.conf (local): current_only = 1

Via wmi.conf (remote) : current_only = 1

Re: Universal Forwarder - Start collection without indexing old logs

zindain24 — Mon, 28 Sep 2020 11:58:00 GMT

Thanks ysouchon, added the following to inputs.conf:

[WinEventLog:Security]
disabled = 0
start_from = oldest
current_only = 1
index = indexname

[WinEventLog:System]
disabled = 0
start_from = oldest
current_only = 1
index = indexname

[WinEventLog:Application]
disabled = 0
start_from = oldest
current_only = 1
index = indexname

Re: Universal Forwarder - Start collection without indexing old logs

criazuelo_splun — Mon, 21 Oct 2019 07:46:12 GMT

This solution didn't work with a UF v 7.3.2 and Windows Server 2012R2 standard.

Re: Universal Forwarder - Start collection without indexing old logs

criazuelo_splun — Mon, 21 Oct 2019 07:47:56 GMT

This solution didn't work with a UF v 7.3.2 and Windows Server 2012R2 standard.