WinEventLog inputs: Why does current_only=1 skip server reboot events?

[lycollicott]

Here is my inputs.conf stanza from Splunk_TA_windows

[WinEventLog://Security]
disabled = 0
start_from = oldest
current_only = 1
evt_resolve_ad_obj = 1
checkpointInterval = 5
blacklist = 4656,4658,4663,5156
index = wineventlog
renderXml=false

When we rolled out Splunk we set current_only=1, because we didn't want all of the old events ingested from all of our servers. This morning I was looking for some server reboot information and went looking for event code 4608 ("Windows is starting up"), but it was nowhere in Splunk for any server ever. I logged on to a particular server which I knew had been rebooted today and found 4608 was logged on the server.

So, it appears that current_only=1 applies to every time Splunk starts, not just the first time like I thought. That means that during a server reboot we do not collect any of the server events that occur before the Spunk service comes back online. I found another post where someone else experienced a similar thing.

I changed the setting from 1 to 0 on a lightly used server to test this theory and rebooted it. This time 4608 was collected and I think (famous last words) that Splunk only ingested events in the gap.

Is that the actual way in which the parameter is intended to work?

[twinspop · Accepted solution]

Yes, I believe that is as intended. From the spec:

current_only = [0|1]
* If set to 1, the input will only acquire events that arrive while Splunk is
  running and the input is enabled.  Data which was stored in the Windows Event
  Log while splunk was not running will not be read.
  This means that there will be gaps in data if splunk is restarted, or
  experiences downtime.

[lycollicott]

LOL, how did I miss that in everything I read this morning? I think I better go to lunch before I hurt myself!

[twinspop]

hah, we've all been there!