topic Re: After a change to inputs.conf to get Windows security event logs, why am I getting error &quot;Failed to checkpoint for channel='security'&quot;? in Getting Data In https://community.splunk.com/t5/Getting-Data-In/After-a-change-to-inputs-conf-to-get-Windows-security-event-logs/m-p/159584#M32379 <P>i think i fixed it, stopped the service for few second and start it again. Thanks ! </P> Thu, 18 Jun 2015 06:53:52 GMT abovebeyond 2015-06-18T06:53:52Z After a change to inputs.conf to get Windows security event logs, why am I getting error "Failed to checkpoint for channel='security'"? https://community.splunk.com/t5/Getting-Data-In/After-a-change-to-inputs-conf-to-get-Windows-security-event-logs/m-p/159581#M32376 <P>Hello, </P> <P>I've changed some whitelist parameters in the inputs.conf file to index Windows security event logs, however, I'm seeing the error:</P> <PRE><CODE>message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exe"" splunk-winevtlog - WinEventMon::processLogChannel: Failed to checkpoint for channel='security' </CODE></PRE> <P>What is the problem?</P> <P>Thanks! </P> Wed, 17 Jun 2015 13:53:44 GMT https://community.splunk.com/t5/Getting-Data-In/After-a-change-to-inputs-conf-to-get-Windows-security-event-logs/m-p/159581#M32376 abovebeyond 2015-06-17T13:53:44Z Re: After a change to inputs.conf to get Windows security event logs, why am I getting error "Failed to checkpoint for channel='security'"? https://community.splunk.com/t5/Getting-Data-In/After-a-change-to-inputs-conf-to-get-Windows-security-event-logs/m-p/159582#M32377 <P>Does your forwarder run as different user other than system? If so you may have permission issue. Other wise post a input stanza.</P> Wed, 17 Jun 2015 19:41:47 GMT https://community.splunk.com/t5/Getting-Data-In/After-a-change-to-inputs-conf-to-get-Windows-security-event-logs/m-p/159582#M32377 bmacias84 2015-06-17T19:41:47Z Re: After a change to inputs.conf to get Windows security event logs, why am I getting error "Failed to checkpoint for channel='security'"? https://community.splunk.com/t5/Getting-Data-In/After-a-change-to-inputs-conf-to-get-Windows-security-event-logs/m-p/159583#M32378 <P>Check out this.. <A href="http://answers.splunk.com/answers/129420/wineventmon-processlogchannel-unable-to-checkpoint.html">http://answers.splunk.com/answers/129420/wineventmon-processlogchannel-unable-to-checkpoint.html</A></P> Thu, 18 Jun 2015 01:08:18 GMT https://community.splunk.com/t5/Getting-Data-In/After-a-change-to-inputs-conf-to-get-Windows-security-event-logs/m-p/159583#M32378 splunker12er 2015-06-18T01:08:18Z Re: After a change to inputs.conf to get Windows security event logs, why am I getting error "Failed to checkpoint for channel='security'"? https://community.splunk.com/t5/Getting-Data-In/After-a-change-to-inputs-conf-to-get-Windows-security-event-logs/m-p/159584#M32379 <P>i think i fixed it, stopped the service for few second and start it again. Thanks ! </P> Thu, 18 Jun 2015 06:53:52 GMT https://community.splunk.com/t5/Getting-Data-In/After-a-change-to-inputs-conf-to-get-Windows-security-event-logs/m-p/159584#M32379 abovebeyond 2015-06-18T06:53:52Z