I went ahead and successfully configured event fowarding and subscriptions (winrm/wecutil). Now is it possible to have all logs that have already happened to be fowarded to my collector? Or is it only events going forward that will be logged?
You can try this:
WECUtil SS "SubscriptionName" /cm:custom /ree:true
This should be done before the Subscription is started. In other words, after you create the subscription disable it, then run the above command, then renable it. The list will then populate
To your subscription xml-configuration file, inside the