topic Re: In which props.conf file should I change the MAX_DAYS_AGO setting? in Getting Data In

In which props.conf file should I change the MAX_DAYS_AGO setting?

vibe2 — Tue, 29 Sep 2020 18:14:41 GMT

I'm trying to change the MAX_DAYS_AGO value in the props.conf file, but there are a lot of props.conf files so i'm not sure which one to change.

livehybrid — Mon, 05 Mar 2018 21:55:40 GMT

Hi,
You should make your changes in $SPLUNK_HOME/etc/system/local/props.conf
This will override the default value.
e.g.

[mySourceType]
MAX_DAYS_AGO = 3650

I hope this helps.

ddrillic — Mon, 05 Mar 2018 22:59:09 GMT

It's a good idea to complement it with ignoreOlderThan = <num of days>d on the forwarder...

splunkreal — Tue, 29 Sep 2020 21:37:34 GMT

Hello, do you add MAX_DAYS_AGO on props.conf forwarder-side? Thanks.