Getting Data In

How do you change the checkpointInterval setting in inputs.conf to alter the interval that data is being sent by forwarder?

davidblizzard
Explorer

Good morning all. I am having an issue with capturing Windows Event Viewer logs. I am getting the data but I'd like to have it sent at a different interval than the forwarder is using. I've set the checkpontInterval = setting to many different settings, but the data is updating every 3-5 seconds no matter what the setting is set to. I've posted the relevant inputs.conf lines below. Any help would be appreciated.

thanks,

[WinEventLog://System]
index = windowssystemlogs
checkpointInterval = 120
current_only = 0
disabled = 0
start_from = oldest
0 Karma
Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...