Getting Data In
Highlighted

How can I index an event older than 10951 days if that is the max value of MAX_DAYS_AGO?

Communicator

Hi all.

Say I want to index an event from "10/1/1970", but the max value of 「MAXDAYSAGO is 10951.
So, I cannot index the event of "10/1/1970", because the event of "10/1/1970" is older than 10951 days.

How can I index an event from more than 10951 days ago?

thanks.

Tags (2)
0 Karma
Highlighted

Re: How can I index an event older than 10951 days if that is the max value of MAX_DAYS_AGO?

Splunk Employee
Splunk Employee

10951 is the current maximum for this setting. You cannot increase it beyond this value.

MAXDAYSAGO =
* Specifies the maximum number of days past, from the current date, that an
extracted date can be valid.
* For example, if MAXDAYSAGO = 10, Splunk ignores dates that are older
than 10 days ago.
* Defaults to 2000 (days), maximum 10951.
* IMPORTANT: If your data is older than 2000 days, increase this setting.

View solution in original post

0 Karma
Highlighted

Re: How can I index an event older than 10951 days if that is the max value of MAX_DAYS_AGO?

Communicator

Thank you for reply exix.
I see that I cannot index an event from "10/1/1970"
Thank you.

0 Karma