Getting Data In

Forwarder not pulling in past Window events

Path Finder

I'm trying to pull in all the existing events from the Windows logs for a machine (application, security, & system). I thought I had the inputs.conf setup correctly, but it is only pulling in events from the time that I pushed the inputs.conf file out (from the deployment server). Below is the inputs.conf section:

[WinEventLog:Application]
disabled = 0
startfrom = oldest
current
only = 0
checkpointInterval = 5
index=emn_investigation

[WinEventLog:Security]
disabled = 0
startfrom = oldest
current
only = 0
evtresolveadobj = 1
checkpointInterval = 5
index=emn
investigation

[WinEventLog:System]
disabled = 0
startfrom = oldest
current
only = 0
checkpointInterval = 5
index=emn_investigation

Am I missing a setting? Do I need to remove the current_only = 0 setting? This data is going into a new index so I can delete the data completely if I need to try something else.

Tags (2)
0 Karma

Splunk Employee
Splunk Employee

Did you by any chance configure this forwarders inputs multiple times so that it may have been monitoring and so it remembers the former position?

You can clean out the forwarders memory of where it was in the event long by running the command "splunk clean all".

Omid

0 Karma

Splunk Employee
Splunk Employee

You could try deleting the files in the fishbucket directory located at $SPLUNK_home/var/lib/splunk/fishbucket

Be sure the forwarder is stopped.

0 Karma

Path Finder

I believe the "splunk clean all" would work for my issue, but the forwarder was installed remotely using psexec and I'm unable log into the console. When I try to run "splunk clean all" through psexec it freezes and does not appear to do anything. Do you know where onthe forwarder this information is stored? Seems I could manually wipe the file instead.

0 Karma