All Apps and Add-ons

Run-away indexing with Splunk add-on for AWS, how to enforce a Log Start Date

Glasses
Builder

Hi,
I was moving about 20 aws data inputs (s3 sources) from an EOL server to an aws ec2.
The ec2 was a clone and had the Splunk_TA_aws app on it.
When I started up the new ec2, I disabled the TA.
I configured the Log Start Date directly in the inputs.conf for all the data inputs (and restarted).
Then I enabled the TA and disabled each of the inputs with the WebUI.
I went 1 by 1 disabling the input on the old host and enabling the input on the new host.
Everything looked good but now my indexing is blowing up.
I set the Log Start Date to 7/1/2019 but it seems the new ec2 host is fetching data before that date, like its not obeying the configs.

Any help is appreciated, thank you.

Glasses
Builder

Because I upgraded the AWS app, it did not retain my start date/time settings. I created new ones and it worked.

Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...