Getting Data In

Inputs.conf to monitor in given time range only

meenal901
Communicator

Hi,

I have a situation: The logs are getting generated 24x7, but the client wants to monitor only during offline hours (18:55 to 07:00). Even if I stop Splunk in online hours, the logs will get indexed.. Is there a solution where I tell splunk to index only in given time range or ignore events older than last 1 hour? The ignoreolderthan parameter of inputs.conf works on last modified date of the files, what about the events within?

Any help would be great!

Thanks.

Tags (1)
0 Karma

esix_splunk
Splunk Employee
Splunk Employee

Use cron to stop/start your syslog listener during that time..

0 Karma

kml_uvce
Builder

use transforms and props.conf file and drop online events(not index) , match _time field in regex in transforms.conf
see route and filter data in http://docs.splunk.com/Documentation/Splunk/6.2.1/Forwarding/Routeandfilterdatad

kamal singh bisht
0 Karma

MuS
Legend

out of pure curiosity, how would you do an regex on an epoch time for those online hours?

0 Karma

meenal901
Communicator

Agreed.. It may not be possible to filter out based on REGEX in props/transforms.

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...