Getting Data In

How to configure Splunk to only index data from a database from the last 30 days?

singhh4
Path Finder

I have a database that stores proxy info which I want to index. The problem is that there is way too much data and I don't want to index all of it. I would prefer to only index the last 30 days worth of info. I couldn't find anything when looking through the index setting besides setting a storage limit. If I can't find a way to limit the indexing time, then I will have to use storage limit. Please help!

0 Karma
1 Solution

MuS
Legend

Hi singhh4,

If you're getting the data into Splunk using a inputs.conf , reading a database dump for example, you can add the ignoreOlderThan option to set the this limit. This causes the monitored input to stop checking files for updates if their modtime has passed this threshold.

If you're getting the data into Splunk using a database query, simply use the query to only return the last 30 days worth of data.

Hope this helps ...

cheers, MuS

View solution in original post

MuS
Legend

Hi singhh4,

If you're getting the data into Splunk using a inputs.conf , reading a database dump for example, you can add the ignoreOlderThan option to set the this limit. This causes the monitored input to stop checking files for updates if their modtime has passed this threshold.

If you're getting the data into Splunk using a database query, simply use the query to only return the last 30 days worth of data.

Hope this helps ...

cheers, MuS

Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...