topic Re: Restart Splunk_TA_opseclea but ignore old data in Getting Data In

Restart Splunk_TA_opseclea but ignore old data

Kmishkind — Mon, 28 Sep 2020 16:10:49 GMT

We had to shut down Splunk_TA_opseclea as we worked to manage our data flow. We are ready to restart the forwarder but I want to ignore the history. What is the best way to do that.

We tried ignoreOlderThan = 1d when we setup the app last week but the indexer refused to start (unfortunately I don't have the error info on that)

Maybe someone has some insight regarding the OPSEC app that would try to help us...we just want to get the forwarder started without a huge inrush of data.

Thanks

Re: Restart Splunk_TA_opseclea but ignore old data

dmaislin_splunk — Wed, 19 Mar 2014 15:37:34 GMT

Have you tried adding this to props.conf:

MAX_DAYS_AGO = <integer>
* Specifies the maximum number of days past, from the current date, that an extracted date
  can be valid.
* For example, if MAX_DAYS_AGO = 10, Splunk ignores dates that are older than 10 days ago.
* Defaults to 2000 (days), maximum 10951.
* IMPORTANT: If your data is older than 2000 days, increase this setting.

http://docs.splunk.com/Documentation/Splunk/6.0.2/Admin/Propsconf

Re: Restart Splunk_TA_opseclea but ignore old data

Kmishkind — Wed, 19 Mar 2014 18:15:26 GMT

Thanks,
that worked!

Re: Restart Splunk_TA_opseclea but ignore old data

Alteek — Mon, 28 Sep 2020 17:37:56 GMT

Hi,

Same issue here, but changing the PROPS.conf didn't help.
Tried to add the MAX_DAYS_AGO in the [DEFAULT], or even in each stanza.

Additional info, I'm working with a Heavy Forwarded.

Thanks