Getting Data In

Can you make universal forwarders only ingest files older than X minutes?


Trying to ingest file ONLY older than 10 minutes. I know the universal forwarder can ignore files older than X but looking for the opposite.

Tags (1)
0 Karma

Revered Legend

Any specific reason for this condition?

0 Karma


I don't believe this would be possible, nor do I know of a setting for it.

If you were ignoring anything older than 10 minutes, you would eventually start capturing data within that 10 minute window as time progressed forward. There would just be about a 10 minute delay on the data coming into your indexer.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!