https://community.splunk.com/t5/Splunk-Dev/Adding-Data-Sources-for-Today/m-p/415135#M7208 <P>I want to be able to only pull *.log files or *.txt files from a specific folder from log files for the current day only. I dont need past history or the previous day's logs.</P> <P>I am trying to limit the amount of messages Splunk is getting to avoid License overages.</P> Thu, 29 Nov 2018 23:53:45 GMT rprasch 2018-11-29T23:53:45Z https://community.splunk.com/t5/Splunk-Dev/Adding-Data-Sources-for-Today/m-p/415135#M7208 <P>I want to be able to only pull *.log files or *.txt files from a specific folder from log files for the current day only. I dont need past history or the previous day's logs.</P> <P>I am trying to limit the amount of messages Splunk is getting to avoid License overages.</P> Thu, 29 Nov 2018 23:53:45 GMT https://community.splunk.com/t5/Splunk-Dev/Adding-Data-Sources-for-Today/m-p/415135#M7208 rprasch 2018-11-29T23:53:45Z https://community.splunk.com/t5/Splunk-Dev/Adding-Data-Sources-for-Today/m-p/415136#M7209 <P>Once all the files are pulled in, Splunk will only read new files - those from today. You may go over your license quota for a day or two, but there's no penalty.</P> <P>If you don't want to do that. you could set <CODE>ignoreOlderThan = 1d</CODE> in inputs.conf. Be careful, however, if Splunk is down for a day, it won't process skipped files when it restarts.</P> Fri, 30 Nov 2018 02:36:43 GMT https://community.splunk.com/t5/Splunk-Dev/Adding-Data-Sources-for-Today/m-p/415136#M7209 richgalloway 2018-11-30T02:36:43Z