We are a 90% Windows environment. Since we upgraded to 4.3.1, the WMI log format has changed ever so slightly. While this is not an issue with splunk, it is an issue with the 3rd party MSSP we are forwarding logs to. As Splunk hasn't responded with a fix or workaround since we upgraded (3 weeks), i would like to downgrade my forwarders back 4.2.3. As the only way to downgrade it to re-install, this will collect everything in the windows event logs, not just where it left off. As this affect 500+ windows boxes, we do not want to do that.
Is there an easy way to set current_only = 1 for all hosts in WMI.conf? Is it as easy as this?
[default]
current_only = 1
[WMI:host1]
event_log_file - Application, Security, System
interval = 5
server= host1
[WMI:host2]
event_log_file - Application, Security, System
interval = 5
server= host2
...
