Getting Data In

Stanza for to ingest logs from specific date

phanichintha
Path Finder

Hello Team,

I want the stanza to ingest logs from a specific date in Linux or Window environment.

Currently am using windows (ignoreOlderThan = 365d) and the same using for Linux it's not working.

Requirement: I want to ingest logs from Linux via UF and windows machines to Splunk, so I want only 356days or 180days. Can anyone share other than the above stanza?

Example:

 [WinEventLog://Security]
disabled = 0
index = trendmicro
sourcetype = %trendmicro%
ignoreOlderThan = 365d
whitelist = 4625,4648,4723,4728,4732,4740,4777,5031,4624,4634

 

 

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

The ignoreOlderThan setting is for monitor inputs, not WinEventLog.  I'm not aware of a setting that controls how far back into the event log the forwarder will read.

---
If this reply helps you, Karma would be appreciated.
0 Karma

phanichintha
Path Finder

Hello Rich,

If that is not the case, can you please which stanza can I use for my question?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

As I said in my original answer, I'm not aware of ANY settings that do what you want.

However, ingestion of older events is a one-time happening so why not just let it happen?  

---
If this reply helps you, Karma would be appreciated.
0 Karma

phanichintha
Path Finder

please suggest some stanzas to find out the way.

0 Karma
Get Updates on the Splunk Community!

Discover Powerful New Features in Splunk Cloud Platform: Enhanced Analytics, ...

Hey Splunky people! We are excited to share the latest updates in Splunk Cloud Platform 9.3.2408. In this ...

Splunk Classroom Chronicles: Training Tales and Testimonials

Welcome to the "Splunk Classroom Chronicles" series, created to help curious, career-minded learners get ...

Access Tokens Page - New & Improved

Splunk Observability Cloud recently launched an improved design for the access tokens page for better ...