Getting Data In

How to configure forwarder to only forward events of the current day ?

john_q
Explorer

I have a 20 days events in one log file but i want to monitor today's events only. i tried below stanza but not worked as what i expected

[monitor:///xx/xxx/x.log]
disabled = false
index = xxx
sourcetype = access_combined
ignoreOlderThan = 0d

0 Karma

traxxasbreaker
Communicator

The ignoreOlderThan setting is based on the difference between the current time and the modification time on the file. So if the file is being appended to every day, then it's always going to show a time stamp of that day as the modification time and not be ruled out by the ignoreOlderThan setting.

It sounds like you more likely want something like the followTail option in inputs.conf, but don't leave it enabled for too long because the documentation implies that if you restart a forwarder leaving it enabled, the input may skip over events that were written to the file during the time it was restarting. If you start the forwarder with the followTail option enabled, wait a couple minutes, then take it out and restart, that should hopefully do what you are looking for.

0 Karma

ddrillic
Ultra Champion

ignoreOlderThan = 1d for 1 day... ?

0 Karma

john_q
Explorer

Yes i tried but not worked

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...