https://community.splunk.com/t5/Getting-Data-In/Windows-event-log-collection-randomly-stops/m-p/110564#M23212 <P>There is a bug (SPL-64915 - WinEventLog InputChannel stop collecting data due to constant timeout.)<BR /> This is fixed in version 5.0.5 and greater.</P> Mon, 13 Jan 2014 10:38:12 GMT abonuccelli_spl 2014-01-13T10:38:12Z https://community.splunk.com/t5/Getting-Data-In/Windows-event-log-collection-randomly-stops/m-p/110563#M23211 <P>I am collecting WinEventLog (not using WMI) data using a Universal Forwarder, Heavy Forwarder or full Splunk Instance, I'm using versions prior to 5.0.5, and data collection randomly stops; the host I'm collecting data from is surely not idle and generating a fair amount of WinEvents, I am not using WMI. I can see _internal/audit data coming in. A restart fixes the problem, however this happens again at some point. </P> <P>I have enabled DEBUG and seeing this after the issue happens...</P> <P>DEBUG WinEventLogInputProcessor - main-thread: Waiting for Windows Event Log with timeout=10000.<BR /> DEBUG WinEventLogInputProcessor - main-thread: Waiting for Windows Event Log with timeout=10000.<BR /> DEBUG WinEventLogInputProcessor - main-thread: Waiting for Windows Event Log with timeout=10000.<BR /> DEBUG WinEventLogInputProcessor - main-thread: Waiting for Windows Event Log with timeout=10000.</P> Mon, 13 Jan 2014 10:35:37 GMT https://community.splunk.com/t5/Getting-Data-In/Windows-event-log-collection-randomly-stops/m-p/110563#M23211 abonuccelli_spl 2014-01-13T10:35:37Z https://community.splunk.com/t5/Getting-Data-In/Windows-event-log-collection-randomly-stops/m-p/110564#M23212 <P>There is a bug (SPL-64915 - WinEventLog InputChannel stop collecting data due to constant timeout.)<BR /> This is fixed in version 5.0.5 and greater.</P> Mon, 13 Jan 2014 10:38:12 GMT https://community.splunk.com/t5/Getting-Data-In/Windows-event-log-collection-randomly-stops/m-p/110564#M23212 abonuccelli_spl 2014-01-13T10:38:12Z