Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Configuration for Identify & Index events with fut...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi Splunker's,
Events coming for future dates, how to identify the future events and index them.
Thanks,
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
Add the following configuration in props.conf along with time stamp recognition.
Props.conf:
MAX_DAYS_HENCE = <integer>
Sample configuration will look next 3 days,
MAX_DAYS_HENCE = 3
Maximum Integer value is 10950 (days).
Gothrough the following Links ,
http://docs.splunk.com/Documentation/Splunk/6.2.4/Data/Configuretimestamprecognition
http://docs.splunk.com/Documentation/Splunk/6.2.4/admin/Propsconf
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The answer by @vasanthmss is a good one and the one I would have given (but he got there first). The answer assumes that it is correct and proper for you go get events "from the future" and so we are accommodating/allowing them. But perhaps that is not what you desire; are you trying to fix/prevent events from the future?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
we are looking for the hence day.
Thanks Woodcook,
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
Add the following configuration in props.conf along with time stamp recognition.
Props.conf:
MAX_DAYS_HENCE = <integer>
Sample configuration will look next 3 days,
MAX_DAYS_HENCE = 3
Maximum Integer value is 10950 (days).
Gothrough the following Links ,
http://docs.splunk.com/Documentation/Splunk/6.2.4/Data/Configuretimestamprecognition
http://docs.splunk.com/Documentation/Splunk/6.2.4/admin/Propsconf
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Announcing Modern Navigation: A New Era of Splunk User Experience
Modernize your Splunk Apps – Introducing Python 3.13 in Splunk
Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...
