https://community.splunk.com/t5/Getting-Data-In/Inputs-conf-quot-MonitorNoHandle-quot-event-start-date-issue/m-p/532201#M89483 <P>We are pulling in DNS debug logs from windows servers and I have a few servers that have been running for awhile, but I have we are now adding inputs to pull in the event logs now. After pushing out the new inputs to the UFs, I noticed that the log files must have data starting around March of this year. At the rate it is ingesting we won't ever catch up and I don't need to be pulling in that old data.</P><P>We are using the "MonitorNoHandle" within the inputs to do so, but from my research I can't find any switches that will allow me to start collecting the "new" events only going forward. I found that the windows monitors has the "start_from" parameter, but that does not seem to work/apply to the MonitorNoHandle stanza from what I can tell. Are there options I am missing that would do this?</P> Mon, 07 Dec 2020 15:09:43 GMT riegelo 2020-12-07T15:09:43Z https://community.splunk.com/t5/Getting-Data-In/Inputs-conf-quot-MonitorNoHandle-quot-event-start-date-issue/m-p/532201#M89483 <P>We are pulling in DNS debug logs from windows servers and I have a few servers that have been running for awhile, but I have we are now adding inputs to pull in the event logs now. After pushing out the new inputs to the UFs, I noticed that the log files must have data starting around March of this year. At the rate it is ingesting we won't ever catch up and I don't need to be pulling in that old data.</P><P>We are using the "MonitorNoHandle" within the inputs to do so, but from my research I can't find any switches that will allow me to start collecting the "new" events only going forward. I found that the windows monitors has the "start_from" parameter, but that does not seem to work/apply to the MonitorNoHandle stanza from what I can tell. Are there options I am missing that would do this?</P> Mon, 07 Dec 2020 15:09:43 GMT https://community.splunk.com/t5/Getting-Data-In/Inputs-conf-quot-MonitorNoHandle-quot-event-start-date-issue/m-p/532201#M89483 riegelo 2020-12-07T15:09:43Z