https://community.splunk.com/t5/Getting-Data-In/Force-agent-to-not-send-events-before-a-given-time/m-p/59442#M96872 <P>With regular file-monitor inputs you can use the <CODE>ignoreOlderThan</CODE> directive. For instance</P> <PRE><CODE>[monitor:///path/to/the/input] ignoreOlderThan = 1d </CODE></PRE> <P><A href="http://docs.splunk.com/Documentation/Splunk/5.0/Admin/Inputsconf">http://docs.splunk.com/Documentation/Splunk/5.0/Admin/Inputsconf</A></P> Tue, 11 Dec 2012 09:56:01 GMT Ayn 2012-12-11T09:56:01Z https://community.splunk.com/t5/Getting-Data-In/Force-agent-to-not-send-events-before-a-given-time/m-p/59441#M96871 <P>Hi *,</P> <P>I'm in development environment and I'd like to not receive all the old data from the agent.</P> <P>I have one server and some agents, and I delete indexes for cleaning reasons from Splunk server, but when I restart the splunk service, all the old data comes through.</P> <P>How can I tell the agents (or the server) to not send me the events before 1 day?<BR /> Or before 3 hours ... or anything custom.</P> <P>Thanks!</P> Tue, 11 Dec 2012 09:46:44 GMT https://community.splunk.com/t5/Getting-Data-In/Force-agent-to-not-send-events-before-a-given-time/m-p/59441#M96871 horizonsecurity 2012-12-11T09:46:44Z https://community.splunk.com/t5/Getting-Data-In/Force-agent-to-not-send-events-before-a-given-time/m-p/59442#M96872 <P>With regular file-monitor inputs you can use the <CODE>ignoreOlderThan</CODE> directive. For instance</P> <PRE><CODE>[monitor:///path/to/the/input] ignoreOlderThan = 1d </CODE></PRE> <P><A href="http://docs.splunk.com/Documentation/Splunk/5.0/Admin/Inputsconf">http://docs.splunk.com/Documentation/Splunk/5.0/Admin/Inputsconf</A></P> Tue, 11 Dec 2012 09:56:01 GMT https://community.splunk.com/t5/Getting-Data-In/Force-agent-to-not-send-events-before-a-given-time/m-p/59442#M96872 Ayn 2012-12-11T09:56:01Z