Getting Data In
Highlighted

inputs.conf ignore older than typo

Splunk Employee
Splunk Employee

Splunk continues to throw an error about the ignoreOlderThan flag on a windows UF. Any ideas?

Checking conf files for typos... Possible typo in stanza
[WinEventLog:Application] in C:\Program Files\SplunkUniversalForwarder\etc\apps\
MSICreated\local\inputs.conf, line 3: ignoreOlderThan = 2d

Here is the text in the inputs.conf:

[WinEventLog:Application]
disabled = 0
ignoreOlderThan = 2d
index = test

[WinEventLog:ForwardedEvents]

[WinEventLog:HardwareEvents]

[WinEventLog:Internet Explorer]

[WinEventLog:Security]
disabled = 0
ignoreOlderThan = 2d
index = test

[WinEventLog:Setup]

[WinEventLog:System]
disabled = 0
ignoreOlderThan = 2d
index = test

0 Karma
Highlighted

Re: inputs.conf ignore older than typo

Splunk Employee
Splunk Employee

through testing i found that adding "current_only = 1" seemed to do the trick

0 Karma
Highlighted

Re: inputs.conf ignore older than typo

SplunkTrust
SplunkTrust

Where did you add it?

0 Karma
Highlighted

Re: inputs.conf ignore older than typo

Splunk Employee
Splunk Employee

under -> Program Files\SplunkUniversalForwarder\etc\apps\MSICreated\local\inputs.conf

[WinEventLog:System]
disabled = 0
index = test
current_only = 1

0 Karma
Highlighted

Re: inputs.conf ignore older than typo

Ultra Champion

current_only is more like followTail in non-winevtlog inputs.

0 Karma
Highlighted

Re: inputs.conf ignore older than typo

Splunk Employee
Splunk Employee

So would you recommend using this or is there a better option?

0 Karma