Getting Data In

How Splunk collects data after a specific time

spl_stu
Explorer
A file directory needs to be collected, but there is a large amount of historical data in the file directory. If I currently point to collecting data from the last three days, is there a parameter to control the collection of files after the specified time?
0 Karma

PickleRick
SplunkTrust
SplunkTrust

There are parameters which restrict monitor inputs to reading only recently modified files (https://docs.splunk.com/Documentation/Splunk/latest/admin/inputsconf - see the ignoreOlderThan parameter). But this parameter applies to file modification time, not the event time.

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...