topic Re: inputs.conf ignore older than typo in Getting Data In

inputs.conf ignore older than typo

aaronkorn — Tue, 21 May 2013 17:06:36 GMT

Splunk continues to throw an error about the ignoreOlderThan flag on a windows UF. Any ideas?

Checking conf files for typos... Possible typo in stanza
[WinEventLog:Application] in C:\Program Files\SplunkUniversalForwarder\etc\apps\
MSICreated\local\inputs.conf, line 3: ignoreOlderThan = 2d

Here is the text in the inputs.conf:

[WinEventLog:Application]
disabled = 0
ignoreOlderThan = 2d
index = test

[WinEventLog:ForwardedEvents]

[WinEventLog:HardwareEvents]

[WinEventLog:Internet Explorer]

[WinEventLog:Security]
disabled = 0
ignoreOlderThan = 2d
index = test

[WinEventLog:Setup]

[WinEventLog:System]
disabled = 0
ignoreOlderThan = 2d
index = test

Re: inputs.conf ignore older than typo

aaronkorn — Tue, 21 May 2013 18:33:31 GMT

through testing i found that adding "current_only = 1" seemed to do the trick

Re: inputs.conf ignore older than typo

jkat54 — Tue, 21 May 2013 18:36:43 GMT

Where did you add it?

Re: inputs.conf ignore older than typo

aaronkorn — Tue, 21 May 2013 18:38:36 GMT

under -> Program Files\SplunkUniversalForwarder\etc\apps\MSICreated\local\inputs.conf

[WinEventLog:System]
disabled = 0
index = test
current_only = 1

Re: inputs.conf ignore older than typo

kristian_kolb — Tue, 21 May 2013 18:48:57 GMT

current_only is more like followTail in non-winevtlog inputs.

Re: inputs.conf ignore older than typo

aaronkorn — Tue, 21 May 2013 18:57:27 GMT

So would you recommend using this or is there a better option?