topic Re: Configuration for Identify & Index events with future date in Getting Data In

Configuration for Identify & Index events with future date

krishnarajb2304 — Mon, 10 Aug 2015 21:04:35 GMT

Hi Splunker's,

Events coming for future dates, how to identify the future events and index them.

Thanks,

Re: Configuration for Identify & Index events with future date

vasanthmss — Mon, 10 Aug 2015 21:05:36 GMT

Hi,

Add the following configuration in props.conf along with time stamp recognition.

Props.conf:

MAX_DAYS_HENCE = <integer>

Sample configuration will look next 3 days,

MAX_DAYS_HENCE = 3

Maximum Integer value is 10950 (days).

Gothrough the following Links ,

http://docs.splunk.com/Documentation/Splunk/6.2.4/Data/Configuretimestamprecognition
http://docs.splunk.com/Documentation/Splunk/6.2.4/admin/Propsconf

Re: Configuration for Identify & Index events with future date

woodcock — Mon, 10 Aug 2015 21:08:55 GMT

The answer by @vasanthmss is a good one and the one I would have given (but he got there first). The answer assumes that it is correct and proper for you go get events "from the future" and so we are accommodating/allowing them. But perhaps that is not what you desire; are you trying to fix/prevent events from the future?

Re: Configuration for Identify & Index events with future date

krishnarajb2304 — Tue, 11 Aug 2015 00:34:17 GMT

we are looking for the hence day.

Thanks Woodcook,