topic Re: Resetting Remote Windows Event collection "starting point" in Getting Data In

Resetting Remote Windows Event collection "starting point"

Richfez — Tue, 19 Aug 2014 20:54:19 GMT

While testing some training materials, I created a temporary index and a remote windows event collection input for my own PC.

Then I deleted it and recreated it exactly as it had been. Again, testing docs for training. 😞

But my newly recreated input only grabbed events newer than the last time it indexed it and ignored the 2 or 3 weeks of previous entries. I figured this wasn't too big of a deal, I've reset file monitoring and database monitoring before, but I can't figure out how to reset the remote windows event collections.

I saw this: I tried http://answers.splunk.com/answers/30006/how-do-i-trigger-the-re-indexing-of-events-from-a-locally-collected-windows-event-log-channel
But when I open the appropriate file in there with an SQLlite DB viewer I only have 8 rows for other inputs, nothing for the one I need to start over.

So, does anyone have any ideas?

Re: Resetting Remote Windows Event collection "starting point"

Richfez — Wed, 20 Aug 2014 14:41:58 GMT

Resolved, with some help from Support getting me in the right location.

I realized that the DB mentioned in the original question was old data, so I searched my system for another copy of said DB and found one in D:\splunk. Don't remember when I moved it, but whatever. 🙂

Unfortunately, while that one had newer information in it, it still wasn't quite current. But it got me in the right spot to look around and I found in there a folder d:\splunk\persistentstorage\wmi\ with a file in it "wmi.ini". That file had rows matching the "problem" machine name along with all the other machines I had listed in that input type.

So, to confirm I ...

Deleted the input.
Deleted the temporary index I had been using for that input.
Stopped Splunk.
Edited \persistentstorage\wmi\wmi.ini and removed lines referencing my PC name and saved the file.
Started splunk.
Created new temporary index.
Created new input just like the old one.

That worked as desired and that index now contains all the events my PC has on it instead of only the most recent ones.

NOTE: it appears that version 6.0 switched from recording this information in the SQLlite DB and instead put it in the file I mentioned above.

Re: Resetting Remote Windows Event collection "starting point"

Richfez — Tue, 16 Sep 2014 19:33:50 GMT

Sorry, conversion must have done a number on the formatting.