topic How to verify if ignoreOlderThan is working or not ? in Splunk Search

How to verify if ignoreOlderThan is working or not ?

ram254481493 — Mon, 11 Nov 2019 15:32:24 GMT

Hi I have implemented ignoreOlderThan for 7 days , I want to verify it if its working or not ? Is their any query or any place in DMC where i can validate that its working ?

Re: How to verify if ignoreOlderThan is working or not ?

mayurr98 — Mon, 11 Nov 2019 15:39:20 GMT

you can look for event timestamps:

if you are getting events older than 7 days so it's not working.

you could check

... | timechart span=1d count

If you have events older than 7 days before making this configuration then check for the count if it's increasing or it's constant.
that way you could determine if ignoreOlderThan is working or not.

Re: How to verify if ignoreOlderThan is working or not ?

ram254481493 — Mon, 11 Nov 2019 16:02:43 GMT

thanks after making the change i will validate.

Re: How to verify if ignoreOlderThan is working or not ?

mayurr98 — Mon, 11 Nov 2019 16:45:43 GMT

sure, let me know.

Re: How to verify if ignoreOlderThan is working or not ?

ram254481493 — Wed, 30 Sep 2020 02:59:12 GMT

@mayurr98 hi i amde the change yesterday for ignore older than 14 days after implementing it i can see the data over 30 days coming and didnt see any effect of it my settings are below:
[WinEventLog://System]
disabled = false
start_from = oldest
current_only = 1
checkpointInterval = 5
index = wineventlog
renderXml=false
ignoreOlderThan = 14d

after adding these settings i run this query for 30 days |tstats count WHERE index=wineventlog by _time span=1d and i can see the data of 30 days not sure why its not working ?

Re: How to verify if ignoreOlderThan is working or not ?

mayurr98 — Thu, 14 Nov 2019 15:11:05 GMT

Did you change these settings or it's a new input that you wrote?

was this input already there and then you added ignoreOlderThan ?

Re: How to verify if ignoreOlderThan is working or not ?

ram254481493 — Thu, 14 Nov 2019 15:13:02 GMT

@mayur98 yes this input is already there and i just added ignoreolderthan and change the current_only = 0 to 1

Re: How to verify if ignoreOlderThan is working or not ?

mayurr98 — Thu, 14 Nov 2019 15:20:52 GMT

Yeah, so the already indexed data won't get affected. this attribute only affects from the time you make the change.

Re: How to verify if ignoreOlderThan is working or not ?

ram254481493 — Thu, 14 Nov 2019 15:23:02 GMT

ok got it , but is their any way that we can verify it that its working properly ?

Re: How to verify if ignoreOlderThan is working or not ?

mayurr98 — Thu, 14 Nov 2019 15:27:56 GMT

yeah. so whatever is ingested will remain constant after this change. So for example, if x number events are already indexed then it won't increase. It will remain the same. you need to look at those numbers and see if they are changing or not.

Re: How to verify if ignoreOlderThan is working or not ?

ram254481493 — Thu, 14 Nov 2019 15:40:08 GMT

sure thanks mayur i can see the change