https://community.splunk.com/t5/Getting-Data-In/ad-logs-question/m-p/196208#M39031 <P>Hi,</P> <P>I noticed that our AD log inputs has a "start_from = oldest" entry. My question is, with this setting, if the forwarder is restarted, is it going to grab all the data, and probably give me duplicate data?</P> Tue, 07 Jul 2015 14:50:50 GMT a212830 2015-07-07T14:50:50Z https://community.splunk.com/t5/Getting-Data-In/ad-logs-question/m-p/196208#M39031 <P>Hi,</P> <P>I noticed that our AD log inputs has a "start_from = oldest" entry. My question is, with this setting, if the forwarder is restarted, is it going to grab all the data, and probably give me duplicate data?</P> Tue, 07 Jul 2015 14:50:50 GMT https://community.splunk.com/t5/Getting-Data-In/ad-logs-question/m-p/196208#M39031 a212830 2015-07-07T14:50:50Z https://community.splunk.com/t5/Getting-Data-In/ad-logs-question/m-p/196209#M39032 <P>The short answer is "no". Even without that line, <CODE>oldest</CODE> is the default setting so it would do that anyway. This just tells Splunk how to process a backlog: oldest-&gt;newest or newest-&gt;oldest. Read about it here:</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/latest/Admin/inputsconf">http://docs.splunk.com/Documentation/Splunk/latest/Admin/inputsconf</A></P> Tue, 07 Jul 2015 15:07:16 GMT https://community.splunk.com/t5/Getting-Data-In/ad-logs-question/m-p/196209#M39032 woodcock 2015-07-07T15:07:16Z