I'm trying to change the MAX_DAYS_AGO value in the props.conf file, but there are a lot of props.conf files so i'm not sure which one to change.
You should make your changes in $SPLUNK_HOME/etc/system/local/props.conf
This will override the default value.
MAX_DAYS_AGO = 3650
I hope this helps.
View solution in original post
Hello, do you add MAX_DAYS_AGO on props.conf forwarder-side? Thanks.
It's a good idea to complement it with ignoreOlderThan = <num of days>d on the forwarder...
ignoreOlderThan = <num of days>d