https://community.splunk.com/t5/Getting-Data-In/How-can-I-reindex-a-WinEventLog-file-with-Splunk-TA-windows/m-p/304074#M57381 <P>Yes, although this is a Dev environment so I don't mind if those are disrupted.</P> Thu, 22 Feb 2018 15:52:27 GMT andrewaalin 2018-02-22T15:52:27Z https://community.splunk.com/t5/Getting-Data-In/How-can-I-reindex-a-WinEventLog-file-with-Splunk-TA-windows/m-p/304071#M57378 <P>crcSalt does not work with this type of input.<BR /> If this were not binary data, I would do some text substitution with sed, but I don't know of a way to do that with binary evtx.</P> Wed, 21 Feb 2018 22:20:47 GMT https://community.splunk.com/t5/Getting-Data-In/How-can-I-reindex-a-WinEventLog-file-with-Splunk-TA-windows/m-p/304071#M57378 andrewaalin 2018-02-21T22:20:47Z https://community.splunk.com/t5/Getting-Data-In/How-can-I-reindex-a-WinEventLog-file-with-Splunk-TA-windows/m-p/304072#M57379 <P>Are you monitoring any other files from the forwarder where you want to collect WinEventLogs?</P> Wed, 21 Feb 2018 22:41:22 GMT https://community.splunk.com/t5/Getting-Data-In/How-can-I-reindex-a-WinEventLog-file-with-Splunk-TA-windows/m-p/304072#M57379 somesoni2 2018-02-21T22:41:22Z https://community.splunk.com/t5/Getting-Data-In/How-can-I-reindex-a-WinEventLog-file-with-Splunk-TA-windows/m-p/304073#M57380 <P>WinEventLog is a modular input, it does not monitor files, but query the windows Winevent endpoint.<BR /> Splunk uses a checkpoint to identify the latest event id collected per channel.</P> <P>If you want to reindex a channel, you can reset the checkpoint.<BR /> 1- stop splunk<BR /> 2 - Look on the forwarder in a folder like $SPLUNK_HOME\var\lib\splunk\modinputs\wineventlogs<BR /> and in side the folder you will find a file (xml format) for each channel (security, applications etc..)<BR /> 3- remove the file<BR /> 4- restart splunk<BR /> it should cause the forwarder to forget the last checkpoints, and restart from the beginning.<BR /> warning : It may cause duplicates, as it will resend them all, and it may take some time to backfill all the events, if they are several month of old data.</P> Thu, 22 Feb 2018 00:57:59 GMT https://community.splunk.com/t5/Getting-Data-In/How-can-I-reindex-a-WinEventLog-file-with-Splunk-TA-windows/m-p/304073#M57380 yannK 2018-02-22T00:57:59Z https://community.splunk.com/t5/Getting-Data-In/How-can-I-reindex-a-WinEventLog-file-with-Splunk-TA-windows/m-p/304074#M57381 <P>Yes, although this is a Dev environment so I don't mind if those are disrupted.</P> Thu, 22 Feb 2018 15:52:27 GMT https://community.splunk.com/t5/Getting-Data-In/How-can-I-reindex-a-WinEventLog-file-with-Splunk-TA-windows/m-p/304074#M57381 andrewaalin 2018-02-22T15:52:27Z https://community.splunk.com/t5/Getting-Data-In/How-can-I-reindex-a-WinEventLog-file-with-Splunk-TA-windows/m-p/304075#M57382 <P>Thanks, trying this out now.</P> Thu, 22 Feb 2018 15:52:44 GMT https://community.splunk.com/t5/Getting-Data-In/How-can-I-reindex-a-WinEventLog-file-with-Splunk-TA-windows/m-p/304075#M57382 andrewaalin 2018-02-22T15:52:44Z https://community.splunk.com/t5/Getting-Data-In/How-can-I-reindex-a-WinEventLog-file-with-Splunk-TA-windows/m-p/304076#M57383 <P>That worked, thanks!</P> Thu, 22 Feb 2018 17:12:55 GMT https://community.splunk.com/t5/Getting-Data-In/How-can-I-reindex-a-WinEventLog-file-with-Splunk-TA-windows/m-p/304076#M57383 andrewaalin 2018-02-22T17:12:55Z https://community.splunk.com/t5/Getting-Data-In/How-can-I-reindex-a-WinEventLog-file-with-Splunk-TA-windows/m-p/304077#M57384 <P><IMG src="https://cdn.gamerant.com/wp-content/uploads/Vault-Boy-Thumbs-Up.jpg.optimal.jpg" alt="alt text" /></P> Thu, 22 Feb 2018 17:29:06 GMT https://community.splunk.com/t5/Getting-Data-In/How-can-I-reindex-a-WinEventLog-file-with-Splunk-TA-windows/m-p/304077#M57384 yannK 2018-02-22T17:29:06Z