Getting Data In

How can I index an event older than 10951 days if that is the max value of MAX_DAYS_AGO?

akanno
Communicator

Hi all.

Say I want to index an event from "10/1/1970", but the max value of 「MAX_DAYS_AGO is 10951.
So, I cannot index the event of "10/1/1970", because the event of "10/1/1970" is older than 10951 days.

How can I index an event from more than 10951 days ago?

thanks.

Tags (2)
0 Karma
1 Solution

esix_splunk
Splunk Employee
Splunk Employee

10951 is the current maximum for this setting. You cannot increase it beyond this value.

MAX_DAYS_AGO =
* Specifies the maximum number of days past, from the current date, that an
extracted date can be valid.
* For example, if MAX_DAYS_AGO = 10, Splunk ignores dates that are older
than 10 days ago.
* Defaults to 2000 (days), maximum 10951.
* IMPORTANT: If your data is older than 2000 days, increase this setting.

View solution in original post

0 Karma

esix_splunk
Splunk Employee
Splunk Employee

10951 is the current maximum for this setting. You cannot increase it beyond this value.

MAX_DAYS_AGO =
* Specifies the maximum number of days past, from the current date, that an
extracted date can be valid.
* For example, if MAX_DAYS_AGO = 10, Splunk ignores dates that are older
than 10 days ago.
* Defaults to 2000 (days), maximum 10951.
* IMPORTANT: If your data is older than 2000 days, increase this setting.

0 Karma

akanno
Communicator

Thank you for reply exix.
I see that I cannot index an event from "10/1/1970"
Thank you.

0 Karma
Get Updates on the Splunk Community!

Index This | What did the zero say to the eight?

June 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...