How Polling "interval" affect the granularity of the data ?

[chimbudp]

Eg:1 inputs.conf

[WinEventLog:Application]
disabled = 0
index = My_index

interval = 300

Eg:2
[WinEventLog:Security]
disabled = 0
index = My_index

interval = 1800

In the above inputs.conf example :
Data being captured and sent every 5 min and 30 min resp as per the configs.

What is the difference in it ? I could able to get the data every 5 min & every 30 min resp.
How this actually affect the granularity of the data ?
will some data not send when i set to 30 min interval ?

[BobM · Accepted solution]

This does not affect the granularity of event logs at all. All events will be collected with their individual timestamps.

Windows can not cope with continuous requests and in some cases misdiagnoses it as a Denial of Service attack and shuts down access to the service. To prevent this, we schedule collection. Having the schedule too close can look like continuous collection especially if other splunk inputs or other programs are also collecting logs. Having it too far apart means our search results are not up to the minute which could give time for someone to clear the logs to hide their actions.

I would set this to between 30 sec for critical systems to 5 minutes for less critical ones.

For performance collection, it does affect granularity and a variety of intervals may be appropriate.