Forwarder not pulling in past Window events

[kmcconnell]

I'm trying to pull in all the existing events from the Windows logs for a machine (application, security, & system). I thought I had the inputs.conf setup correctly, but it is only pulling in events from the time that I pushed the inputs.conf file out (from the deployment server). Below is the inputs.conf section:

[WinEventLog:Application]
disabled = 0
start_from = oldest
current_only = 0
checkpointInterval = 5
index=emn_investigation

[WinEventLog:Security]
disabled = 0
start_from = oldest
current_only = 0
evt_resolve_ad_obj = 1
checkpointInterval = 5
index=emn_investigation

[WinEventLog:System]
disabled = 0
start_from = oldest
current_only = 0
checkpointInterval = 5
index=emn_investigation

Am I missing a setting? Do I need to remove the current_only = 0 setting? This data is going into a new index so I can delete the data completely if I need to try something else.

[okrabbe_splunk]

Did you by any chance configure this forwarders inputs multiple times so that it may have been monitoring and so it remembers the former position?

You can clean out the forwarders memory of where it was in the event long by running the command "splunk clean all".

Omid

[okrabbe_splunk]

You could try deleting the files in the fishbucket directory located at $SPLUNK_home/var/lib/splunk/fishbucket

Be sure the forwarder is stopped.

[kmcconnell]

I believe the "splunk clean all" would work for my issue, but the forwarder was installed remotely using psexec and I'm unable log into the console. When I try to run "splunk clean all" through psexec it freezes and does not appear to do anything. Do you know where onthe forwarder this information is stored? Seems I could manually wipe the file instead.