Getting Data In

WinEventLog inputs: Why does current_only=1 skip server reboot events?

lycollicott
Motivator

Here is my inputs.conf stanza from Splunk_TA_windows

[WinEventLog://Security]
disabled = 0
start_from = oldest
current_only = 1
evt_resolve_ad_obj = 1
checkpointInterval = 5
blacklist = 4656,4658,4663,5156
index = wineventlog
renderXml=false

When we rolled out Splunk we set current_only=1, because we didn't want all of the old events ingested from all of our servers. This morning I was looking for some server reboot information and went looking for event code 4608 ("Windows is starting up"), but it was nowhere in Splunk for any server ever. I logged on to a particular server which I knew had been rebooted today and found 4608 was logged on the server.

So, it appears that current_only=1 applies to every time Splunk starts, not just the first time like I thought. That means that during a server reboot we do not collect any of the server events that occur before the Spunk service comes back online. I found another post where someone else experienced a similar thing.

I changed the setting from 1 to 0 on a lightly used server to test this theory and rebooted it. This time 4608 was collected and I think (famous last words) that Splunk only ingested events in the gap.

Is that the actual way in which the parameter is intended to work?

0 Karma
1 Solution

twinspop
Influencer

Yes, I believe that is as intended. From the spec:

current_only = [0|1]
* If set to 1, the input will only acquire events that arrive while Splunk is
  running and the input is enabled.  Data which was stored in the Windows Event
  Log while splunk was not running will not be read.
  This means that there will be gaps in data if splunk is restarted, or
  experiences downtime.

View solution in original post

twinspop
Influencer

Yes, I believe that is as intended. From the spec:

current_only = [0|1]
* If set to 1, the input will only acquire events that arrive while Splunk is
  running and the input is enabled.  Data which was stored in the Windows Event
  Log while splunk was not running will not be read.
  This means that there will be gaps in data if splunk is restarted, or
  experiences downtime.

lycollicott
Motivator

LOL, how did I miss that in everything I read this morning? I think I better go to lunch before I hurt myself!

0 Karma

twinspop
Influencer

hah, we've all been there!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...