Monitoring Splunk

timeframe for monitoring old files

a212830
Champion

Hi,

Will the UF ignore files that are older than a certain value? I am testing against some old files (january), and it doesn't appear to be picking them up.

Tags (1)
0 Karma
1 Solution

bmacias84
Champion

This depends on how you defined your monitor stanza in your inputs.conf. By default ignoreOlderThan settings is disabled and recurisve settings is true

If your stanza is defined like such it will pick up all file in directory and sub-directories


[monitor:///var/log]

If youwant to limit which log files to be monitored:

[monitor:///var/log]
ignoreOlderThan=3d
recurisve=false

Also use the btool to determine which settings are being applied by which apps or TAs.

i.e. ./splunk btool --debug inputs list

Additional Reading:

Inputsconf

View solution in original post

bmacias84
Champion

This depends on how you defined your monitor stanza in your inputs.conf. By default ignoreOlderThan settings is disabled and recurisve settings is true

If your stanza is defined like such it will pick up all file in directory and sub-directories


[monitor:///var/log]

If youwant to limit which log files to be monitored:

[monitor:///var/log]
ignoreOlderThan=3d
recurisve=false

Also use the btool to determine which settings are being applied by which apps or TAs.

i.e. ./splunk btool --debug inputs list

Additional Reading:

Inputsconf

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...