Getting Data In

How can I reindex a [WinEventLog://___] file with Splunk_TA_windows?

andrewaalin
Explorer

crcSalt does not work with this type of input.
If this were not binary data, I would do some text substitution with sed, but I don't know of a way to do that with binary evtx.

0 Karma
1 Solution

yannK
Splunk Employee
Splunk Employee

WinEventLog is a modular input, it does not monitor files, but query the windows Winevent endpoint.
Splunk uses a checkpoint to identify the latest event id collected per channel.

If you want to reindex a channel, you can reset the checkpoint.
1- stop splunk
2 - Look on the forwarder in a folder like $SPLUNK_HOME\var\lib\splunk\modinputs\wineventlogs
and in side the folder you will find a file (xml format) for each channel (security, applications etc..)
3- remove the file
4- restart splunk
it should cause the forwarder to forget the last checkpoints, and restart from the beginning.
warning : It may cause duplicates, as it will resend them all, and it may take some time to backfill all the events, if they are several month of old data.

View solution in original post

yannK
Splunk Employee
Splunk Employee

WinEventLog is a modular input, it does not monitor files, but query the windows Winevent endpoint.
Splunk uses a checkpoint to identify the latest event id collected per channel.

If you want to reindex a channel, you can reset the checkpoint.
1- stop splunk
2 - Look on the forwarder in a folder like $SPLUNK_HOME\var\lib\splunk\modinputs\wineventlogs
and in side the folder you will find a file (xml format) for each channel (security, applications etc..)
3- remove the file
4- restart splunk
it should cause the forwarder to forget the last checkpoints, and restart from the beginning.
warning : It may cause duplicates, as it will resend them all, and it may take some time to backfill all the events, if they are several month of old data.

andrewaalin
Explorer

Thanks, trying this out now.

0 Karma

andrewaalin
Explorer

That worked, thanks!

0 Karma

yannK
Splunk Employee
Splunk Employee

alt text

somesoni2
Revered Legend

Are you monitoring any other files from the forwarder where you want to collect WinEventLogs?

0 Karma

andrewaalin
Explorer

Yes, although this is a Dev environment so I don't mind if those are disrupted.

0 Karma
Get Updates on the Splunk Community!

Security Highlights: September 2022 Newsletter

 September 2022 The Splunk App for Fraud Analytics (SFA) is now Splunk SupportedUse your existing Splunk ...

Platform Highlights | September 2022 Newsletter

 September 2022 What’s New in 9.0 and How to UpgradeGet a walk through of what is new Splunk Enterprise 9.0 ...

Observability Highlights | September 2022 Newsletter

 September 2022 Splunk Observability SuiteAccess to "Classic" SignalFx Interface Will be Removed on Sept 30, ...