Getting Data In

How do you change the checkpointInterval setting in inputs.conf to alter the interval that data is being sent by forwarder?

davidblizzard
Explorer

Good morning all. I am having an issue with capturing Windows Event Viewer logs. I am getting the data but I'd like to have it sent at a different interval than the forwarder is using. I've set the checkpontInterval = setting to many different settings, but the data is updating every 3-5 seconds no matter what the setting is set to. I've posted the relevant inputs.conf lines below. Any help would be appreciated.

thanks,

[WinEventLog://System]
index = windowssystemlogs
checkpointInterval = 120
current_only = 0
disabled = 0
start_from = oldest
0 Karma
Get Updates on the Splunk Community!

Application management with Targeted Application Install for Victoria Experience

  Experience a new era of flexibility in managing your Splunk Cloud Platform apps! With Targeted Application ...

Index This | What goes up and never comes down?

January 2026 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Splunkers, Pack Your Bags: Why Cisco Live EMEA is Your Next Big Destination

The Power of Two: Splunk + Cisco at "Ludicrous Scale"   You know Splunk. You know Cisco. But have you seen ...