Getting Data In

Can you make universal forwarders only ingest files older than X minutes?


Trying to ingest file ONLY older than 10 minutes. I know the universal forwarder can ignore files older than X but looking for the opposite.

Tags (1)
0 Karma

Revered Legend

Any specific reason for this condition?

0 Karma


I don't believe this would be possible, nor do I know of a setting for it.

If you were ignoring anything older than 10 minutes, you would eventually start capturing data within that 10 minute window as time progressed forward. There would just be about a 10 minute delay on the data coming into your indexer.

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.