topic Re: How to configure Splunk Forwarder to NOT index historical data in Getting Data In

How to configure Splunk Forwarder to NOT index historical data

vrmandadi — Mon, 04 Nov 2019 15:54:22 GMT

Recently we had issues with one of the data inputs which uses rest API add-on, sending a large volume of data.
So I have disabled the three inputs of the data type in the heavy forwarder.
I would like to enable back the inputs but I would like to get the data starting from today.
I assume once I enable it back I would get all the data that was disabled for the few days.
Is there any setting that will get the latest or today's data and where should the setting be placed?

Thanks in advance.

Re: How to configure Splunk Forwarder to NOT index historical data

gcusello — Mon, 04 Nov 2019 16:00:53 GMT

Hi vrmandadi,
in inputs.conf use the ignoreOlderThan=1d option ( https://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf ).
Ciao.
Giuseppe

Re: How to configure Splunk Forwarder to NOT index historical data

vrmandadi — Mon, 04 Nov 2019 16:31:21 GMT

Hello @gcusello thank you very much for your reply .Will this setting once enabled today will get only today's data and not the days this inputs were disabled right?

Can we use this input on a index setting ?

Re: How to configure Splunk Forwarder to NOT index historical data

gcusello — Mon, 04 Nov 2019 16:55:27 GMT

Hi vrmandadi,
You have to use this option in an inputs.conf stanza, e.g.:

[monitor:///var/log/messages]
index=os
sourcetype=linux
ignoreOlderThan=1d

See in the documentation ( https://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf )instructions and samples.

Ciao.
Giuseppe

Re: How to configure Splunk Forwarder to NOT index historical data

vrmandadi — Mon, 04 Nov 2019 17:14:36 GMT

Thank You.

Re: How to configure Splunk Forwarder to NOT index historical data

gcusello — Tue, 05 Nov 2019 08:29:52 GMT

You're welcome!
Ciao and next time.
Giuseppe