topic Re: Index previous log from remote windows host in Getting Data In

Index previous log from remote windows host

katalinali — Fri, 05 Nov 2010 12:22:43 GMT

I install splunk 4.1.5 and input windows eventlog from remote host, but I find splunk just index data from date of installation. I have modified apps\search\local\inputs.conf with [WMI:WinEventLog:System] as start_from = oldest && current_only = 0. But splunk still don't index the previous log. Can anyone give some suggestions?

Re: Index previous log from remote windows host

hulahoop — Sat, 06 Nov 2010 06:32:53 GMT

Your input should be [WinEventLog:System] not [WMI:WinEventLog:System] if you are running Splunk as a light or regular forwarder.

If you want to use WMI, then the entry for system event logs is:

[WMI:AppAndSys]
server = foo, bar
interval = 10
event_log_file = System
disabled = 0

http://www.splunk.com/base/Documentation/latest/Admin/MonitorWMIdata