https://community.splunk.com/t5/Getting-Data-In/Configure-interval-for-forwarding-Windows-Event-Logs-to/m-p/17353#M2210 <P>You might do so by accessing the events through scripted WMI inputs instead of EventLog monitoring. That way you could set a time interval. </P> <P>The whole point about splunk "monitor" is speed, so I don't think it is possible to tune it down and have it poll logs every 15 minutes.</P> <P>If you want to limit network usage, you can tune the limits.conf file.</P> Wed, 14 Jul 2010 18:16:34 GMT Paolo_Prigione 2010-07-14T18:16:34Z https://community.splunk.com/t5/Getting-Data-In/Configure-interval-for-forwarding-Windows-Event-Logs-to/m-p/17352#M2209 <P>I installed Splunk on a Windows DC and configured it as Light Forwarder to send the events to a linux based Splunk Indexer / Search.</P> <P>Now, I would like to <STRONG>forward the events</STRONG> from the Windows Server for <STRONG>every 15 minutes</STRONG>. Presently any event that is generated on the server are going in realtime.</P> <P>How can i configure the above?</P> Wed, 14 Jul 2010 18:02:28 GMT https://community.splunk.com/t5/Getting-Data-In/Configure-interval-for-forwarding-Windows-Event-Logs-to/m-p/17352#M2209 klkumar10 2010-07-14T18:02:28Z https://community.splunk.com/t5/Getting-Data-In/Configure-interval-for-forwarding-Windows-Event-Logs-to/m-p/17353#M2210 <P>You might do so by accessing the events through scripted WMI inputs instead of EventLog monitoring. That way you could set a time interval. </P> <P>The whole point about splunk "monitor" is speed, so I don't think it is possible to tune it down and have it poll logs every 15 minutes.</P> <P>If you want to limit network usage, you can tune the limits.conf file.</P> Wed, 14 Jul 2010 18:16:34 GMT https://community.splunk.com/t5/Getting-Data-In/Configure-interval-for-forwarding-Windows-Event-Logs-to/m-p/17353#M2210 Paolo_Prigione 2010-07-14T18:16:34Z