Getting Data In

Set Current only for all in WMI.conf?

I-Man
Communicator

We are a 90% Windows environment. Since we upgraded to 4.3.1, the WMI log format has changed ever so slightly. While this is not an issue with splunk, it is an issue with the 3rd party MSSP we are forwarding logs to. As Splunk hasn't responded with a fix or workaround since we upgraded (3 weeks), i would like to downgrade my forwarders back 4.2.3. As the only way to downgrade it to re-install, this will collect everything in the windows event logs, not just where it left off. As this affect 500+ windows boxes, we do not want to do that.

Is there an easy way to set current_only = 1 for all hosts in WMI.conf? Is it as easy as this?

[default]
current_only = 1

[WMI:host1]
event_log_file - Application, Security, System
interval = 5
server= host1

[WMI:host2]
event_log_file - Application, Security, System
interval = 5
server= host2

...
Tags (2)
0 Karma
1 Solution

I-Man
Communicator

Ok, setup a test machine and tried it out. Putting "current_only = 1" under default does work. It is as simple as that.

View solution in original post

I-Man
Communicator

Ok, setup a test machine and tried it out. Putting "current_only = 1" under default does work. It is as simple as that.

Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...