exclude winevent older than 7 days from ingest

[Andre_]

Hello,

I am about to onboard 1000+ Windows UF. Those have windows event logs going back many years. Is there a way to exclude any windows eventlog older than 7 days from being ingested during the initial onboarding?

For log files there's an option for inputs.conf on the UF, but nothing similar for eventlog?

Kind Regards
Andre

[PrewinThomas]

With current_only = 1
On first start, the UF reads only new events that arrive after the input is enabled.It skips all historical events present in the log at the time the input is first started.

If the UF is stopped and restarted, it will pick up where it left off (using checkpoints), so normally it will ingest events that occurred while it was down.

#https://help.splunk.com/en/splunk-enterprise/get-started/get-data-in/9.4/get-windows-data/monitor-wi...

Regards,
Prewin
Splunk Enthusiast | Always happy to help! If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!

[Andre_]

I think the opposite is the case:

current_only = <boolean>
* Whether or not to acquire only events that arrive while the instance is 
  running.
* A value of "true" means the input only acquires events that arrive
  while the instance runs and the input is on. The input does not read
  data which was stored in the Windows Event Log while the instance was not
  running. This means that there will be gaps in the data if you restart the
  instance or experiences downtime.

[PrewinThomas]

@Andre_ 

You are correct. Unlike file-based inputs, Windows Event Log inputs in Splunk Universal Forwarder (UF) do not provide a built-in option in inputs.conf to exclude events based on their age at collection time. This means you cannot natively configure the UF to only ingest Windows events newer than 7 days during onboarding.

But, If you want to ingest only new Windows Event Log events (and skip all historical data), set current_only = 1 in your inputs.conf.

Regards,
Prewin
Splunk Enthusiast | Always happy to help! If this answer helped you, please consider marking it as the solution or giving a kudos/Karma. Thanks!