Getting Data In
Highlighted

Set Current only for all in WMI.conf?

Communicator

We are a 90% Windows environment. Since we upgraded to 4.3.1, the WMI log format has changed ever so slightly. While this is not an issue with splunk, it is an issue with the 3rd party MSSP we are forwarding logs to. As Splunk hasn't responded with a fix or workaround since we upgraded (3 weeks), i would like to downgrade my forwarders back 4.2.3. As the only way to downgrade it to re-install, this will collect everything in the windows event logs, not just where it left off. As this affect 500+ windows boxes, we do not want to do that.

Is there an easy way to set current_only = 1 for all hosts in WMI.conf? Is it as easy as this?

[default]
current_only = 1

[WMI:host1]
event_log_file - Application, Security, System
interval = 5
server= host1

[WMI:host2]
event_log_file - Application, Security, System
interval = 5
server= host2

...
Tags (2)
0 Karma
Highlighted

Re: Set Current only for all in WMI.conf?

Communicator

Ok, setup a test machine and tried it out. Putting "current_only = 1" under default does work. It is as simple as that.

View solution in original post

Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.