topic Change initial date then stop ingestion in Getting Data In

Change initial date then stop ingestion

karn — Thu, 03 Apr 2025 12:30:35 GMT

I have disabled input (generic S3) of aws add-on for a year. After I enable it, it ingests old data so I disable it and change initial date in inputs.conf. After restarting splunk serevice, I enable it but no data coming. I tried clone and changed only the name. No data coming also. I don't know how to check it. Is it checkpoint issue or somethings? Please help me to check it.

Thanks for Advance

Re: Change initial date then stop ingestion

karn — Thu, 03 Apr 2025 12:57:00 GMT

I change interval time to 600s also.

Re: Change initial date then stop ingestion

livehybrid — Thu, 03 Apr 2025 13:12:24 GMT

Hi @karn

I would have said clone the input, but you've done that? So the name of the input is definately different than the original? The reason I ask is that looking at the code, the checkpoint name is created based on the input name.

The two checkpoint files that the Generic S3 Input creates (key/index ckpt) are stored in the checkpoint directory (typically $SPLUNK_HOME/var/lib/splunk/modinputs/aws_s3) - Can you check in there to see what you have in there?

You could stop Splunk and clear the relevant modinput checkpoint files and then start Splunk again.

If that doesnt work then check you _internal logs for any errors, or more info about which data it is pulling in when the input runs.

🌟 Did this answer help you? If so, please consider:

Adding kudos to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing.