WinEventLog - ignoreOlderThan = 2d

[karlosbh]

We are updating the inputs.conf, with config so we can monitor the event logs as well as IIS logs.

With the IIS logs we have used 'ignoreOlderThan = 2d' so we don't pull back too much data in one go.
When i've tried this with the Event logs...

WinEventLog:Application]
ignoreOlderThan = 2d

I'm getting....

C:\Program Files\SplunkUniversalForwarder\bin>splunk btool check
Possible typo in stanza [WinEventLog:Application] in C:\Program Files\SplunkUniv
ersalForwarder\etc\apps\is-auto-web01\local\inputs.conf, line 16: ignoreOlderTha
n  =  2d
Possible typo in stanza [WinEventLog:Security] in C:\Program Files\SplunkUnivers
alForwarder\etc\apps\is-auto-web01\local\inputs.conf, line 21: ignoreOlderThan
=  2d
Possible typo in stanza [WinEventLog:System] in C:\Program Files\SplunkUniversal
Forwarder\etc\apps\is-auto-web01\local\inputs.conf, line 26: ignoreOlderThan  =
2d

[kristian_kolb · Accepted solution]

Hi,

unfortunately that is not a supported option for Windows Event logs, since they are not read like normal files. There is a similar option that might work for you - current_only=1 - which skips ALL old events, and only read from this point in time and onwards.

See the windows-specific inputs.conf directives (quite far down the page);

http://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf

Hope this helps,

Kristian