Getting Data In

How to configure Splunk to only index data from a database from the last 30 days?

singhh4
Path Finder

I have a database that stores proxy info which I want to index. The problem is that there is way too much data and I don't want to index all of it. I would prefer to only index the last 30 days worth of info. I couldn't find anything when looking through the index setting besides setting a storage limit. If I can't find a way to limit the indexing time, then I will have to use storage limit. Please help!

0 Karma
1 Solution

MuS
Legend

Hi singhh4,

If you're getting the data into Splunk using a inputs.conf , reading a database dump for example, you can add the ignoreOlderThan option to set the this limit. This causes the monitored input to stop checking files for updates if their modtime has passed this threshold.

If you're getting the data into Splunk using a database query, simply use the query to only return the last 30 days worth of data.

Hope this helps ...

cheers, MuS

View solution in original post

MuS
Legend

Hi singhh4,

If you're getting the data into Splunk using a inputs.conf , reading a database dump for example, you can add the ignoreOlderThan option to set the this limit. This causes the monitored input to stop checking files for updates if their modtime has passed this threshold.

If you're getting the data into Splunk using a database query, simply use the query to only return the last 30 days worth of data.

Hope this helps ...

cheers, MuS

Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...