How to configure Splunk to only index data from a database from the last 30 days?

[singhh4]

I have a database that stores proxy info which I want to index. The problem is that there is way too much data and I don't want to index all of it. I would prefer to only index the last 30 days worth of info. I couldn't find anything when looking through the index setting besides setting a storage limit. If I can't find a way to limit the indexing time, then I will have to use storage limit. Please help!

[MuS · Accepted solution]

Hi singhh4,

If you're getting the data into Splunk using a inputs.conf , reading a database dump for example, you can add the ignoreOlderThan option to set the this limit. This causes the monitored input to stop checking files for updates if their modtime has passed this threshold.

If you're getting the data into Splunk using a database query, simply use the query to only return the last 30 days worth of data.

Hope this helps ...

cheers, MuS