Getting Data In

In which props.conf file should I change the MAX_DAYS_AGO setting?

New Member

I'm trying to change the MAX_DAYS_AGO value in the props.conf file, but there are a lot of props.conf files so i'm not sure which one to change.

Tags (2)
0 Karma
1 Solution

Contributor

Hi,
You should make your changes in $SPLUNK_HOME/etc/system/local/props.conf
This will override the default value.
e.g.

[mySourceType]
MAX_DAYS_AGO = 3650 

I hope this helps.

View solution in original post

Builder

Hello, do you add MAX_DAYS_AGO on props.conf forwarder-side? Thanks.

0 Karma

Contributor

Hi,
You should make your changes in $SPLUNK_HOME/etc/system/local/props.conf
This will override the default value.
e.g.

[mySourceType]
MAX_DAYS_AGO = 3650 

I hope this helps.

View solution in original post

Ultra Champion

It's a good idea to complement it with ignoreOlderThan = <num of days>d on the forwarder...

0 Karma