Getting Data In

Splunk Events still coming through despite setting "Disabled=1"

cchitten
Path Finder

I am still receiving and indexing events from my splunk forwarder despite setting "Disabled=1" for everything in inputs.conf.
I have also restarted my splunk indexer instance. Nothing has stopped them.

How often does splunk load settings from the .conf files?

0 Karma
1 Solution

cchitten
Path Finder

You have to manually restart the splunk forwarder. To do this go to the device the forwarder is installed on and run the splunk.exe from the command prompt with the argument restart.

Example:
C:splunkforwardersplunk.exe restart

View solution in original post

0 Karma

cchitten
Path Finder

You have to manually restart the splunk forwarder. To do this go to the device the forwarder is installed on and run the splunk.exe from the command prompt with the argument restart.

Example:
C:splunkforwardersplunk.exe restart

0 Karma

satishsdange
Builder

could you please provide more information e.g. inputs.conf, sample events..that would really help in troubleshooting

0 Karma

cchitten
Path Finder

Example event:

02/23/2015 04:26:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Microsoft Windows security auditing.
ComputerName=*********
TaskCategory=Microsoft Windows security auditing.
OpCode=Microsoft Windows security auditing.
RecordNumber=736244
Keywords=Microsoft Windows security auditing.
Message=Microsoft Windows security auditing.

inputs.conf stanza:

[WinEventLog://ForwardedEvents]
checkpointInterval = 5
current_only = 0
disabled = 1
index = forwardedeventlogs
start_from = oldest
renderXml=1
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...