https://community.splunk.com/t5/Getting-Data-In/Is-the-checkpointInterval-attribute-configurable/m-p/266138#M51001 <P>We have thousands of Universal Forwarders (UF) in a large virtual desktop environment where we need to minimize the footprint and particularly the I/O as much as possible.</P> <P>Question is for WinEventLog configuration in Splunk 6.4.1 UF on Windows 7 x64 use a 60 second checkpointInterval.</P> <P>For example:</P> <PRE><CODE>[WinEventLog://Security] checkpointInterval = 5 evt_resolve_ad_obj = 0 disabled = 0 </CODE></PRE> <P>We believe that for this particular input there's no need to checkpoint every 5 seconds, so hoping to modify this interval to reduce the disk writes to be like below but Splunk is not taking into account the new value ( checkpointInterval = 60 ) </P> <PRE><CODE>[WinEventLog://Security] checkpointInterval = 60 evt_resolve_ad_obj = 0 disabled = 0 </CODE></PRE> Tue, 06 Dec 2016 18:36:12 GMT rbal_splunk 2016-12-06T18:36:12Z https://community.splunk.com/t5/Getting-Data-In/Is-the-checkpointInterval-attribute-configurable/m-p/266138#M51001 <P>We have thousands of Universal Forwarders (UF) in a large virtual desktop environment where we need to minimize the footprint and particularly the I/O as much as possible.</P> <P>Question is for WinEventLog configuration in Splunk 6.4.1 UF on Windows 7 x64 use a 60 second checkpointInterval.</P> <P>For example:</P> <PRE><CODE>[WinEventLog://Security] checkpointInterval = 5 evt_resolve_ad_obj = 0 disabled = 0 </CODE></PRE> <P>We believe that for this particular input there's no need to checkpoint every 5 seconds, so hoping to modify this interval to reduce the disk writes to be like below but Splunk is not taking into account the new value ( checkpointInterval = 60 ) </P> <PRE><CODE>[WinEventLog://Security] checkpointInterval = 60 evt_resolve_ad_obj = 0 disabled = 0 </CODE></PRE> Tue, 06 Dec 2016 18:36:12 GMT https://community.splunk.com/t5/Getting-Data-In/Is-the-checkpointInterval-attribute-configurable/m-p/266138#M51001 rbal_splunk 2016-12-06T18:36:12Z https://community.splunk.com/t5/Getting-Data-In/Is-the-checkpointInterval-attribute-configurable/m-p/266139#M51002 <P>Currently attribute checkpointInterval is not configurable in Splunk and there is open BUg# SPL-128223:::How to change checkpoint interval for modular inputs. This bux is expected to be fixed in next release i.e 6.4.5 and 6.5.2.</P> Tue, 06 Dec 2016 18:37:00 GMT https://community.splunk.com/t5/Getting-Data-In/Is-the-checkpointInterval-attribute-configurable/m-p/266139#M51002 rbal_splunk 2016-12-06T18:37:00Z