Getting Data In

How Polling "interval" affect the granularity of the data ?

chimbudp
Contributor

Eg:1 inputs.conf

[WinEventLog:Application]
disabled = 0
index = My_index

interval = 300

Eg:2
[WinEventLog:Security]
disabled = 0
index = My_index

interval = 1800

In the above inputs.conf example :
Data being captured and sent every 5 min and 30 min resp as per the configs.

What is the difference in it ? I could able to get the data every 5 min & every 30 min resp.
How this actually affect the granularity of the data ?
will some data not send when i set to 30 min interval ?

0 Karma
1 Solution

BobM
Builder

This does not affect the granularity of event logs at all. All events will be collected with their individual timestamps.

Windows can not cope with continuous requests and in some cases misdiagnoses it as a Denial of Service attack and shuts down access to the service. To prevent this, we schedule collection. Having the schedule too close can look like continuous collection especially if other splunk inputs or other programs are also collecting logs. Having it too far apart means our search results are not up to the minute which could give time for someone to clear the logs to hide their actions.

I would set this to between 30 sec for critical systems to 5 minutes for less critical ones.

For performance collection, it does affect granularity and a variety of intervals may be appropriate.

View solution in original post

BobM
Builder

This does not affect the granularity of event logs at all. All events will be collected with their individual timestamps.

Windows can not cope with continuous requests and in some cases misdiagnoses it as a Denial of Service attack and shuts down access to the service. To prevent this, we schedule collection. Having the schedule too close can look like continuous collection especially if other splunk inputs or other programs are also collecting logs. Having it too far apart means our search results are not up to the minute which could give time for someone to clear the logs to hide their actions.

I would set this to between 30 sec for critical systems to 5 minutes for less critical ones.

For performance collection, it does affect granularity and a variety of intervals may be appropriate.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...