Getting Data In

Set Current only for all in WMI.conf?

I-Man
Communicator

We are a 90% Windows environment. Since we upgraded to 4.3.1, the WMI log format has changed ever so slightly. While this is not an issue with splunk, it is an issue with the 3rd party MSSP we are forwarding logs to. As Splunk hasn't responded with a fix or workaround since we upgraded (3 weeks), i would like to downgrade my forwarders back 4.2.3. As the only way to downgrade it to re-install, this will collect everything in the windows event logs, not just where it left off. As this affect 500+ windows boxes, we do not want to do that.

Is there an easy way to set current_only = 1 for all hosts in WMI.conf? Is it as easy as this?

[default]
current_only = 1

[WMI:host1]
event_log_file - Application, Security, System
interval = 5
server= host1

[WMI:host2]
event_log_file - Application, Security, System
interval = 5
server= host2

...
Tags (2)
0 Karma
1 Solution

I-Man
Communicator

Ok, setup a test machine and tried it out. Putting "current_only = 1" under default does work. It is as simple as that.

View solution in original post

I-Man
Communicator

Ok, setup a test machine and tried it out. Putting "current_only = 1" under default does work. It is as simple as that.

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...