How to stop Splunk UF from sending old Windows logs when installing on GUI

[salohiddin]

Hi everyone, I installed a Splunk Universal Forwarder on a Windows server and by default it immediately started sending a huge amount of old Security/System logs. This quickly caused a license violation. Later I saw that in inputs.conf there is a parameter start_from = oldest. But during the UF installation (using the GUI) I didn’t see any option to control this. After installation it just started forwarding everything. So my question is when is the right time to configure start_from?

[livehybrid]

Hi @salohiddin 

Its not possible to set this in the GUI, instead, after you run the installer don’t let the UF start immediately.
Instead, edit (or create) the Windows‑event‑log stanza in

$SPLUNK_HOME\etc\system\local\inputs.conf

(or withing a custom app) before the forwarder first reads any logs. Add the following to the inputs.conf file

[WinEventLog]
current_only = 1

See https://help.splunk.com/en/splunk-enterprise/get-started/get-data-in/9.4/get-windows-data/monitor-wi... for more info on this setting.

Once you have saved the file:

1. Start the forwarder (splunk.exe start or the Windows service).
2. The UF will read only new events and no longer send the historic logs.

If you've already started the UF then stop the service, edit inputs.conf, and restart the service.

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[kiran_panchavat]

@salohiddin 

Refer this https://docs.splunk.com/Documentation/Splunk/9.4.2/Admin/Inputsconf 

start_from = <string>
* How the Event Log input is to chronologically read the Event Log channels.
* A value of "oldest" means that the input reads Windows event logs
  from the oldest to the most recent.
* A value of "newest" means that the input reads Windows event logs
  in reverse, from the most recent to the oldest. After the input consumes
  the backlog of events, it stops.
* If you set this setting to "newest", and at the same time give the
  'current_only' setting a value of "false", the combination can result in the
  input indexing duplicate events.
* Do not set this setting to "newest" and at the same time give the
  'current_only' setting a value of "true". This results in the input not 
  collecting any events because you told it to read existing events
  from newest to oldest and read only incoming events concurrently, which
  is a logically impossible combination.
* Default: oldest

[kiran_panchavat · Accepted solution]

@salohiddin 

With the GUI installer, there’s no option to change this, you have to edit inputs.conf manually before the forwarder starts collecting. Install the UF without selecting Windows Event Logs and make the changes in the inputs.conf.