Getting Data In

Index previous log from remote windows host

Path Finder

I install splunk 4.1.5 and input windows eventlog from remote host, but I find splunk just index data from date of installation. I have modified apps\search\local\inputs.conf with [WMI:WinEventLog:System] as start_from = oldest && current_only = 0. But splunk still don't index the previous log. Can anyone give some suggestions?

Tags (1)
0 Karma

Splunk Employee
Splunk Employee

Your input should be [WinEventLog:System] not [WMI:WinEventLog:System] if you are running Splunk as a light or regular forwarder.

If you want to use WMI, then the entry for system event logs is:

[WMI:AppAndSys]
server = foo, bar
interval = 10
event_log_file = System
disabled = 0

http://www.splunk.com/base/Documentation/latest/Admin/MonitorWMIdata

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!