Archive
Highlighted

Restart Splunk_TA_opseclea but ignore old data

New Member

We had to shut down SplunkTAopseclea as we worked to manage our data flow. We are ready to restart the forwarder but I want to ignore the history. What is the best way to do that.

We tried ignoreOlderThan = 1d when we setup the app last week but the indexer refused to start (unfortunately I don't have the error info on that)

Maybe someone has some insight regarding the OPSEC app that would try to help us...we just want to get the forwarder started without a huge inrush of data.

Thanks

0 Karma
Highlighted

Re: Restart Splunk_TA_opseclea but ignore old data

Motivator

Have you tried adding this to props.conf:

MAX_DAYS_AGO = <integer>
* Specifies the maximum number of days past, from the current date, that an extracted date
  can be valid.
* For example, if MAX_DAYS_AGO = 10, Splunk ignores dates that are older than 10 days ago.
* Defaults to 2000 (days), maximum 10951.
* IMPORTANT: If your data is older than 2000 days, increase this setting.

http://docs.splunk.com/Documentation/Splunk/6.0.2/Admin/Propsconf

View solution in original post

0 Karma
Highlighted

Re: Restart Splunk_TA_opseclea but ignore old data

New Member

Thanks,
that worked!

0 Karma
Highlighted

Re: Restart Splunk_TA_opseclea but ignore old data

Explorer

Hi,

Same issue here, but changing the PROPS.conf didn't help.
Tried to add the MAXDAYSAGO in the [DEFAULT], or even in each stanza.

Additional info, I'm working with a Heavy Forwarded.

Thanks

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.