Getting Data In

How to configure inputs.conf on a Universal Forwarder to only read the current day's file that contains the date?

lmtaylor
Engager

I'm trying to configure inputs.conf to only read the current days file that contains the date. The file name changes daily. An example file name would be: localhost.2015-01-06.log. How do I configure the inputs.conf file to only read current day file on a windows server? I don't want to read all files (localhost.*.log).

somesoni2
Revered Legend

In inputs.conf, there is a property called "ignoreOlderThan". Setting this property will ensure that the files whose last modification time is older than specified values (e.g. 1d, one day) will be ignored. See more here:-

http://docs.splunk.com/Documentation/Splunk/6.1.2/admin/Inputsconf

Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...