Can you make universal forwarders only ingest files older than X minutes?

[ptoro]

Trying to ingest file ONLY older than 10 minutes. I know the universal forwarder can ignore files older than X but looking for the opposite.

[somesoni2]

Any specific reason for this condition?

[ryanoconnor]

I don't believe this would be possible, nor do I know of a setting for it.

If you were ignoring anything older than 10 minutes, you would eventually start capturing data within that 10 minute window as time progressed forward. There would just be about a 10 minute delay on the data coming into your indexer.