Getting Data In

Set Current only for all in WMI.conf?

I-Man
Communicator

We are a 90% Windows environment. Since we upgraded to 4.3.1, the WMI log format has changed ever so slightly. While this is not an issue with splunk, it is an issue with the 3rd party MSSP we are forwarding logs to. As Splunk hasn't responded with a fix or workaround since we upgraded (3 weeks), i would like to downgrade my forwarders back 4.2.3. As the only way to downgrade it to re-install, this will collect everything in the windows event logs, not just where it left off. As this affect 500+ windows boxes, we do not want to do that.

Is there an easy way to set current_only = 1 for all hosts in WMI.conf? Is it as easy as this?

[default]
current_only = 1

[WMI:host1]
event_log_file - Application, Security, System
interval = 5
server= host1

[WMI:host2]
event_log_file - Application, Security, System
interval = 5
server= host2

...
Tags (2)
0 Karma
1 Solution

I-Man
Communicator

Ok, setup a test machine and tried it out. Putting "current_only = 1" under default does work. It is as simple as that.

View solution in original post

I-Man
Communicator

Ok, setup a test machine and tried it out. Putting "current_only = 1" under default does work. It is as simple as that.

Get Updates on the Splunk Community!

Platform Highlights | November 2022 Newsletter

 November 2022 Skill Up on Splunk with our New Builder Tech Talk SeriesCan you build it? Yes you can! *play ...

Splunk Education - Fast Start Program!

Welcome to Splunk Education! Splunk training programs are designed to enable you to get started quickly and ...

Five Subtly Different Ways of Adding Manual Instrumentation in Java

You can find the code of this example on GitHub here. Please feel free to star the repository to keep in ...