Data could not be written:

[bogdan_nicolesc]

I have searched high and low for an answer here and on web, but seems that i can't find a suitable answer.

Did anyone got this error while tring to get data in?

Data could not be written: /nobody/search/inputs/WinEventLog://System/start_from: oldest

I played a bit with System log of windows and at first i used the "Local event log collection" but then changed my mind and changed it to "Remote event log collections".

But yet again, first time, using "Local event log collection" i got older data too, second time using "Remote event log collections" i get only newer data.

What can i do to reset it? In what file should i look?

Thank you.

[bogdan_nicolesc]

Did all that and i get the same error.

[scelikok]

Hi @bogdan_nicolesc,

In order to reset the checkpoint you should delete below file on Windows host and restart Universal Forwarder service.

C:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\System

[bogdan_nicolesc]

Would a pc reboot would do?