How to configure Splunk Forwarder to NOT index historical data

[vrmandadi]

Recently we had issues with one of the data inputs which uses rest API add-on, sending a large volume of data.
So I have disabled the three inputs of the data type in the heavy forwarder.
I would like to enable back the inputs but I would like to get the data starting from today.
I assume once I enable it back I would get all the data that was disabled for the few days.
Is there any setting that will get the latest or today's data and where should the setting be placed?

Thanks in advance.

[gcusello · Accepted solution]

Hi vrmandadi,
in inputs.conf use the ignoreOlderThan=1d option ( https://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf ).
Ciao.
Giuseppe

[vrmandadi]

Hello @gcusello thank you very much for your reply .Will this setting once enabled today will get only today's data and not the days this inputs were disabled right?

Can we use this input on a index setting ?

[gcusello]

Hi vrmandadi,
You have to use this option in an inputs.conf stanza, e.g.:

[monitor:///var/log/messages]
index=os
sourcetype=linux
ignoreOlderThan=1d

See in the documentation ( https://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf )instructions and samples.

Ciao.
Giuseppe

[vrmandadi]

Thank You.

[gcusello]

You're welcome!
Ciao and next time.
Giuseppe