Getting Data In

How do you change the checkpointInterval setting in inputs.conf to alter the interval that data is being sent by forwarder?

davidblizzard
Explorer

Good morning all. I am having an issue with capturing Windows Event Viewer logs. I am getting the data but I'd like to have it sent at a different interval than the forwarder is using. I've set the checkpontInterval = setting to many different settings, but the data is updating every 3-5 seconds no matter what the setting is set to. I've posted the relevant inputs.conf lines below. Any help would be appreciated.

thanks,

[WinEventLog://System]
index = windowssystemlogs
checkpointInterval = 120
current_only = 0
disabled = 0
start_from = oldest
0 Karma
Get Updates on the Splunk Community!

Splunk MCP & Agentic AI: Machine Data Without Limits

  Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization ...

Finding Based Detections General Availability

Overview  We’ve come a long way, folks, but here in Enterprise Security 8.4 I’m happy to announce Finding ...

Get Your Hands Dirty (and Your Shoes Comfy): The Splunk Experience

Hands-On Learning and Technical Seminars  Sometimes, you just need to see the code. For those looking for a ...