We are updating the inputs.conf, with config so we can monitor the event logs as well as IIS logs.
With the IIS logs we have used 'ignoreOlderThan = 2d' so we don't pull back too much data in one go.
When i've tried this with the Event logs...
WinEventLog:Application]
ignoreOlderThan = 2d
I'm getting....
C:\Program Files\SplunkUniversalForwarder\bin>splunk btool check
Possible typo in stanza [WinEventLog:Application] in C:\Program Files\SplunkUniv
ersalForwarder\etc\apps\is-auto-web01\local\inputs.conf, line 16: ignoreOlderTha
n = 2d
Possible typo in stanza [WinEventLog:Security] in C:\Program Files\SplunkUnivers
alForwarder\etc\apps\is-auto-web01\local\inputs.conf, line 21: ignoreOlderThan
= 2d
Possible typo in stanza [WinEventLog:System] in C:\Program Files\SplunkUniversal
Forwarder\etc\apps\is-auto-web01\local\inputs.conf, line 26: ignoreOlderThan =
2d
Hi,
unfortunately that is not a supported option for Windows Event logs, since they are not read like normal files. There is a similar option that might work for you - current_only=1
- which skips ALL old events, and only read from this point in time and onwards.
See the windows-specific inputs.conf directives (quite far down the page);
http://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf
Hope this helps,
Kristian
Hi,
unfortunately that is not a supported option for Windows Event logs, since they are not read like normal files. There is a similar option that might work for you - current_only=1
- which skips ALL old events, and only read from this point in time and onwards.
See the windows-specific inputs.conf directives (quite far down the page);
http://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf
Hope this helps,
Kristian