How can I configure Splunk Forwarder to NOT index historical WinEvents?

[maverick]

I intend to install Splunk as a forwarder on my Windows boxes, but I only want Splunk to monitor for the very latest, most recent Windows events being logged now in real-time and I DO NOT want it to also index all of the historical events that may be logged in the Event Viewer previously.

The reason is, when it starts indexing the historical Win Events, it causes the CPU to spike up initially, and I cannot allow that to happen when I deploy it on a new Windows server.

Can I configure Splunk on Windows to only index real-time data coming in now and avoid causing the CPU to spike upon initial deployment of Splunk?

[Joffer]

What happens if you stop splunk for say one hour and start it again. Will it then continue from where it left off or start from the most current once more, missing one hour of event logs?

[nick405060]

current_only seems intended for initial data setup only, to be the "don't backfill" option. It would make no sense if it also didn't ingest queued data during a reboot. If that were the case there would be a HUGE need for a "current_only_but_keep_data_during_reboots" option, which clearly doesn't exist. Also I think it would go against the paradigm of elegant software development to have current_only not ingest queues after reboots. Also that option of ingesting queues after reboots or not would definitely be specified in a different .conf file and not inputs.conf.

I don't have the official answer for you, but, yes, current_only will definitely still ingest data queues after reboots or short periods of starting and stopping. Long term? Like turning Splunk off for a week? I don't know.

[lorenzoromio]

I have the same question, but it really seems that the option should be interpreted as: "the input only acquires events that arrive while the instance is running and the input is enabled."

inputs.conf - Splunk Documentation

current_only = <boolean>
* Whether or not to acquire only events that arrive while the instance is
  running.
* If you set this setting to 1, the input only acquires events that arrive
  while the instance runs and the input is enabled. The input does not read
  data which was stored in the Windows Event Log while the instance was not
  running. This means that there will be gaps in the data if you restart the
  instance or experiences downtime.

[PickleRick]

Golden shovel for you, as well as for the one whose answer you answered 😉

The original thread is back from 2010 😄

Anyway, yes, that's true - current_only makes the UF subscribe to the eventlog channel upon the start of the service and listen only for the events which come during the forwarder's activity period. Obviously when you stop the service, you can't receive new events.

If you set current_only to false, Splunk will read the backlog from the last saved checkpoint (or from the beginning if this is the first run).

There is no option to read eventlog data only from a certain point in time (similar to ignore_older_than with monitor input). There was a thread not too long ago dealing with ingesting the events from the start but dropping "in transit" event older than a defined threshold but that's definitely not a standard solution.

[gkanapathy · Accepted solution]

current_only: http://docs.splunk.com/Documentation/Splunk/5.0/Data/MonitorWindowsdata

Specify whether to index starting at earliest or most recent event

Use these settings to specify which in chronological order you want to index the events, from oldest->newest or newest->oldest, and whether you want to index all pre-existing events, or just new events.

start_from = oldest current_only = 1 start_from: By default, Splunk starts with the oldest data and indexes forward. We don't recommend changing this setting, as it results in a highly inefficient indexing process. current_only: This option allows you to only index new events, from the moment Splunk was started. It acts like a tail to a file.

[shivarpith]

Hi gkanapathy,

i am dealing with a imilar issue, i am trying to ingest webserver logs and the historical log data in webserver is huge and brought splunk down when i tried to ingest. i want splunk UF to start from the latest or the day before's log file and ingest the new log files that are created in future

Example:
exclude logs till march 27th.
ingest march 28th.log
march 29th.log
march 30th.log
march 31th.log
april 1st.log

.
.
.
.
.
and all log files post march 28th ( normal splunk UF behaviour)

can i use current_only=1 setting or any other suggested recommendation.

Hope i was clear enough. Thanks in advance