Getting Data In

Don't forward old IIS Logs to Splunk

daymar_23
Explorer

Hello All!

I am configuring Splunk in different servers to send the IIS Logs. I am doing it by adding the IIS Log Folder as a Data Input -> Files & Directories. 

But in the IIS Log File there is old Logs, and I only want that send to splunk Logs from no more that two days. 

I already configured in the .props.config the MAX_DAYS_AGO=2, but it doesn't work. 

I have tried in these ways:  

With the file in ...\etc\system\local\props.config 

[iis]
MAX_DAYS_AGO=2

---------------- Didn't work

[default]
MAX_DAYS_AGO=2

------------------Didn't work 

Changing the Default in the ..\etc\system\default\props.config

[default]
MAX_DAYS_AGO=2

------------------Didn't work 

Restarting the Splunk service every time when I made the change 

Could somebody say me what I am missing? 

Thanks 

 

Labels (3)
0 Karma
1 Solution

saravanan90
Contributor

In inputs.conf we configure the file which needs to be monitored as below. We can add the "ignoreOlderThan = 2d" as below in inputs.conf so that it will exclude the files which are older than 2 days.

[monitor://path_to_logfile.log]
disabled = false
index = iis
sourcetype = iis
crcSalt = <SOURCE>
ignoreOlderThan = 2d

 

If we need to go through each individual events and ignore the data then we can add them where it is being parsed. If we are using intermediate Heavy forwarder for parsing, then configure here. If the logs being collected are sent directly to indexers then we can configure the below in indexers.

props.conf

[iis]
MAX_DAYS_AGO=2

View solution in original post

saravanan90
Contributor

In inputs.conf we configure the file which needs to be monitored as below. We can add the "ignoreOlderThan = 2d" as below in inputs.conf so that it will exclude the files which are older than 2 days.

[monitor://path_to_logfile.log]
disabled = false
index = iis
sourcetype = iis
crcSalt = <SOURCE>
ignoreOlderThan = 2d

 

If we need to go through each individual events and ignore the data then we can add them where it is being parsed. If we are using intermediate Heavy forwarder for parsing, then configure here. If the logs being collected are sent directly to indexers then we can configure the below in indexers.

props.conf

[iis]
MAX_DAYS_AGO=2

saravanan90
Contributor

This may help..

1. If the file is older than 2 days we can use  ignoreOlderThan = 2d in inputs.conf in forwarder.

2. Please check the below configuration is in props.conf in HF/Indexer.

[iis]

MAX_DAYS_AGO=2

 

daymar_23
Explorer

Thanks @saravanan90 

Sorry, but I am new using splunk. So what do you mean by HF/Indexer? 

My local props.config looks like: 

[iis]
MAX_DAYS_AGO=2
TRANSFORMS-null = setnull,setNotFound

And under what label do I have to put the ignoreOlderThan = 2d in my local inputs.conf? 

Thanks for your reply. 

0 Karma
Get Updates on the Splunk Community!

Get Operational Insights Quickly with Natural Language on the Splunk Platform

In today’s fast-paced digital world, turning data into actionable insights is essential for success. With ...

What’s New in Splunk Observability Cloud – June 2025

What’s New in Splunk Observability Cloud – June 2025 We are excited to announce the latest enhancements to ...

Almost Too Eventful Assurance: Part 2

Work While You SleepBefore you can rely on any autonomous remediation measures, you need to close the loop ...