Getting Data In

How to configure Splunk to only index data from a database from the last 30 days?

singhh4
Path Finder

I have a database that stores proxy info which I want to index. The problem is that there is way too much data and I don't want to index all of it. I would prefer to only index the last 30 days worth of info. I couldn't find anything when looking through the index setting besides setting a storage limit. If I can't find a way to limit the indexing time, then I will have to use storage limit. Please help!

0 Karma
1 Solution

MuS
Legend

Hi singhh4,

If you're getting the data into Splunk using a inputs.conf , reading a database dump for example, you can add the ignoreOlderThan option to set the this limit. This causes the monitored input to stop checking files for updates if their modtime has passed this threshold.

If you're getting the data into Splunk using a database query, simply use the query to only return the last 30 days worth of data.

Hope this helps ...

cheers, MuS

View solution in original post

MuS
Legend

Hi singhh4,

If you're getting the data into Splunk using a inputs.conf , reading a database dump for example, you can add the ignoreOlderThan option to set the this limit. This causes the monitored input to stop checking files for updates if their modtime has passed this threshold.

If you're getting the data into Splunk using a database query, simply use the query to only return the last 30 days worth of data.

Hope this helps ...

cheers, MuS

Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...