All Apps and Add-ons

How to get the latest logs from a source which does not have timestamp

Builder

I have configured an input through REST API to get data into splunk .Recently I have disabled one input since there was high volume of data coming in.If we enable it back do we get all the historical data , since there is no time stamp? . How to get only the latest data from the time it was enabled and ignore the historical data

Sample event:

[quartzJobExecutor-1] INFO c.c.c.r.c.s.m.i.DataSetMatcherServiceImpl - Computing similarity scores took 0 ms

0 Karma

Esteemed Legend

It depends on the design of the input. The developer should have documented how it works.

0 Karma

SplunkTrust
SplunkTrust

It depends on the API being used. Some will return all events if no start time is specified, but have a limit to how far back they will go.

Why do you not have a timestamp? You could set DATETIME_CONFIG = current for the sourcetype to ensure all events get a timestamp.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

Builder

The source by default dont have timestamp. If we set DATETIME_CONFIG = current , does it ignore historical data and gets only the data at the time of configuration

0 Karma

SplunkTrust
SplunkTrust

DATETIME_CONFIG = current assigns a timestamp to events as they are indexed. It doesn't affect data already indexed. Having a timestamp on your data means you can pick up where you left off.

---
If this reply helps you, an upvote would be appreciated.
0 Karma