Index previous log from remote windows host

[katalinali]

I install splunk 4.1.5 and input windows eventlog from remote host, but I find splunk just index data from date of installation. I have modified apps\search\local\inputs.conf with [WMI:WinEventLog:System] as start_from = oldest && current_only = 0. But splunk still don't index the previous log. Can anyone give some suggestions?

[hulahoop]

Your input should be [WinEventLog:System] not [WMI:WinEventLog:System] if you are running Splunk as a light or regular forwarder.

If you want to use WMI, then the entry for system event logs is:

[WMI:AppAndSys]
server = foo, bar
interval = 10
event_log_file = System
disabled = 0

http://www.splunk.com/base/Documentation/latest/Admin/MonitorWMIdata