Getting Data In

How can I index an event older than 10951 days if that is the max value of MAX_DAYS_AGO?

akanno
Communicator

Hi all.

Say I want to index an event from "10/1/1970", but the max value of 「MAX_DAYS_AGO is 10951.
So, I cannot index the event of "10/1/1970", because the event of "10/1/1970" is older than 10951 days.

How can I index an event from more than 10951 days ago?

thanks.

Tags (2)
0 Karma
1 Solution

esix_splunk
Splunk Employee
Splunk Employee

10951 is the current maximum for this setting. You cannot increase it beyond this value.

MAX_DAYS_AGO =
* Specifies the maximum number of days past, from the current date, that an
extracted date can be valid.
* For example, if MAX_DAYS_AGO = 10, Splunk ignores dates that are older
than 10 days ago.
* Defaults to 2000 (days), maximum 10951.
* IMPORTANT: If your data is older than 2000 days, increase this setting.

View solution in original post

0 Karma

esix_splunk
Splunk Employee
Splunk Employee

10951 is the current maximum for this setting. You cannot increase it beyond this value.

MAX_DAYS_AGO =
* Specifies the maximum number of days past, from the current date, that an
extracted date can be valid.
* For example, if MAX_DAYS_AGO = 10, Splunk ignores dates that are older
than 10 days ago.
* Defaults to 2000 (days), maximum 10951.
* IMPORTANT: If your data is older than 2000 days, increase this setting.

0 Karma

akanno
Communicator

Thank you for reply exix.
I see that I cannot index an event from "10/1/1970"
Thank you.

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...