https://community.splunk.com/t5/Getting-Data-In/How-Splunk-collects-data-after-a-specific-time/m-p/654632#M110964 A file directory needs to be collected, but there is a large amount of historical data in the file directory. If I currently point to collecting data from the last three days, is there a parameter to control the collection of files after the specified time? Thu, 17 Aug 2023 09:17:07 GMT spl_stu 2023-08-17T09:17:07Z https://community.splunk.com/t5/Getting-Data-In/How-Splunk-collects-data-after-a-specific-time/m-p/654632#M110964 A file directory needs to be collected, but there is a large amount of historical data in the file directory. If I currently point to collecting data from the last three days, is there a parameter to control the collection of files after the specified time? Thu, 17 Aug 2023 09:17:07 GMT https://community.splunk.com/t5/Getting-Data-In/How-Splunk-collects-data-after-a-specific-time/m-p/654632#M110964 spl_stu 2023-08-17T09:17:07Z https://community.splunk.com/t5/Getting-Data-In/How-Splunk-collects-data-after-a-specific-time/m-p/654661#M110965 <P>There are parameters which restrict monitor inputs to reading only recently modified files (<A href="https://docs.splunk.com/Documentation/Splunk/latest/admin/inputsconf" target="_blank">https://docs.splunk.com/Documentation/Splunk/latest/admin/inputsconf</A> - see the ignoreOlderThan parameter). But this parameter applies to file modification time, not the event time.</P> Thu, 17 Aug 2023 11:23:10 GMT https://community.splunk.com/t5/Getting-Data-In/How-Splunk-collects-data-after-a-specific-time/m-p/654661#M110965 PickleRick 2023-08-17T11:23:10Z