topic Re: ignoreOlderThan does not work after modification in Getting Data In

Why does ignoreOlderThan not work after modification?

dujas — Thu, 26 May 2022 15:06:34 GMT

Hi All,

I set ignoreOlderThan = 10d and it worked as expected, the files older than 10 days were not searched. Once I set that value to 30d, all files came out. So far it is working as expected.

However, after I set it back to 10d, there was no difference and all files including those ones older than 10 days came out as well, is this as expected? I have restarted both the UF and server.

Thanks.

Re: ignoreOlderThan does not work after modification

gcusello — Thu, 26 May 2022 07:00:08 GMT

Hi @dujas,

olderThan works on the event Timestamp, did you checked the timestamp of the events?

What's the retention of your index?

Ciao.

Giuseppe

Re: ignoreOlderThan does not work after modification

dujas — Thu, 26 May 2022 07:58:58 GMT

Hi Giuseppe,

Thanks for the reply.

The log files older than 10 days were not updated since then, the modification time is not changed at all.

Best Regards,

Jason Du

Re: ignoreOlderThan does not work after modification

gcusello — Thu, 26 May 2022 10:55:40 GMT

Hi @dujas,

sorry I didn't understand you question!

let me understand:

you configured inputs with ignoreOlder=10d and indexed events,
then you configured inputs with ignoreOlder=30d and indexed events,
then you configured again inputs with ignoreOlder=10d and indexed events,
at the end you have events older than 10d,

is this what you did?

In this way you indexed data older than 10d and passing time you have events older than 10 days, so the indexed events are still in Splunk and you can search them until they go out of the retention period.

If you want to discard events older than 10 days also in indexes, you have to confiure a retention of 10 days for your index using the "FrozenTimePeriodInSecs" option in indexes.conf in the your_index stanza.

For more infos see at https://docs.splunk.com/Documentation/Splunk/8.2.6/Admin/Indexesconf

Ciao.

Giuseppe

Re: ignoreOlderThan does not work after modification

dujas — Thu, 26 May 2022 17:07:51 GMT

Thanks Giuseppe, this explanation helps me out.

Re: ignoreOlderThan does not work after modification

gcusello — Fri, 27 May 2022 06:20:04 GMT

Hi @dujas,

good for you, see next time!

If my answer solves your need, please accept it for the other people of Community.

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉