All Apps and Add-ons

AWS SQS Based S3 input - ignore historical data - start ingest from today


Hi all,

I have an issue with a new SQS Based S3 input. There is a large amount of historical data in S3 that I don't want to ingest.

Is there a way to manipulate the pointer used by Splunk when reading S3 so it starts ingesting data from a nominated time, for example today onwards and thereby ignore historical data?

Many thanks,

Tags (2)
0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.