topic Re: what can be done to keep the past in the past? in Splunk Search

what can be done to keep the past in the past?

raomu — Tue, 06 Mar 2018 03:03:00 GMT

Hello,

For the past couple of weeks, we’ve seen events from the past being recently indexed. I assume that these few of the boxes were just powered up, and because of the forwarding infrastructure, that these are “current” events?
what can be done to keep the past in the past?

Thanks.

Re: what can be done to keep the past in the past?

MousumiChowdhur — Tue, 06 Mar 2018 05:41:00 GMT

Hi, do you have a single source from where data is coming or multiple sources?

Re: what can be done to keep the past in the past?

raomu — Tue, 06 Mar 2018 06:23:20 GMT

single source.

Re: what can be done to keep the past in the past?

MousumiChowdhur — Tue, 06 Mar 2018 07:02:04 GMT

Hi, If you have used crcSalt = <SOURCE> from your inputs.conf then you should remove that if you your files get rotated after a certain time duration. Setting crcSalt in such case will cause re-indexing of your data.

Thanks!

Re: what can be done to keep the past in the past?

raomu — Tue, 06 Mar 2018 07:13:00 GMT

Thanks for your reply, but here the issue is not related to re-indexing.

My bad, may be I should have put more information.

Example :

we have some server X , Y

and these 2 servers have log files with year old data.

I installed the fwd and start getting logs from these 2 machines. Now the issue is the logs which is already associated with old or last year time stamps when indexed In spunk will take current time.

example :

event 03/06/017 xyzzy .......... login attempt.

during the index time it will take the current time not the actual event time.

So do we have any way of these types of events already indexed we can setup the indexed time same as event time ?

Re: what can be done to keep the past in the past?

MousumiChowdhur — Tue, 06 Mar 2018 07:30:21 GMT

Hi @raomu,

You can keep the configuration DATETIME_CONFIG = blank in props.conf instead of setting it to CURRENT or NONE that will consider the timestamp of the event.

For your reference https://docs.splunk.com/Documentation/Splunk/7.0.2/Admin/Propsconf

Thanks. Let me know if that helps.