I'm trying to change the MAX_DAYS_AGO value in the props.conf file, but there are a lot of props.conf files so i'm not sure which one to change.
Hi,
You should make your changes in $SPLUNK_HOME/etc/system/local/props.conf
This will override the default value.
e.g.
[mySourceType]
MAX_DAYS_AGO = 3650
I hope this helps.
Hello, do you add MAX_DAYS_AGO on props.conf forwarder-side? Thanks.
Hi,
You should make your changes in $SPLUNK_HOME/etc/system/local/props.conf
This will override the default value.
e.g.
[mySourceType]
MAX_DAYS_AGO = 3650
I hope this helps.
It's a good idea to complement it with ignoreOlderThan = <num of days>d
on the forwarder...