We are updating the inputs.conf, with config so we can monitor the event logs as well as IIS logs.
With the IIS logs we have used 'ignoreOlderThan = 2d' so we don't pull back too much data in one go.
When i've tried this with the Event logs...
WinEventLog:Application]
ignoreOlderThan = 2d
I'm getting....
C:\Program Files\SplunkUniversalForwarder\bin>splunk btool check
Possible typo in stanza [WinEventLog:Application] in C:\Program Files\SplunkUniv
ersalForwarder\etc\apps\is-auto-web01\local\inputs.conf, line 16: ignoreOlderTha
n = 2d
Possible typo in stanza [WinEventLog:Security] in C:\Program Files\SplunkUnivers
alForwarder\etc\apps\is-auto-web01\local\inputs.conf, line 21: ignoreOlderThan
= 2d
Possible typo in stanza [WinEventLog:System] in C:\Program Files\SplunkUniversal
Forwarder\etc\apps\is-auto-web01\local\inputs.conf, line 26: ignoreOlderThan =
2d
... View more