Why isn't ancient entry ignored despite `ignoreOlderThan` config in inputs.conf ?

[_dave_b]

Hello. We have a pesky entry from 80+ days ago that keeps appearing in our search results. We added the ignoreOlderThan setting to the $SPLUNK_HOME\etc\system\local\inputs.conf file, but the old entry continues to appear in the search results.

The stanza from the inputs.conf looks like this

[monitor://c:\Program Files\Microsoft\device\logs\*\MSDevice_MSCP*.txt]
disabled = false
sourcetype = MSDevice_MSCP-MS
ignoreOlderThan = 2d

For good measure, we also changed the inputs.conf file in the app's directory, to look like this:

[monitor://C:\Program Files\Microsoft\device\]
disabled = false
host = bes12
ignoreOlderThan = 48h

And the entry continues to get picked up. Is there any other way I can get Splunk to ignore this (and any other older) entry?
Is there another inputs.conf file that has higher precedence? Should we double up on the backslashes in the .conf files?

Thanks for your insights!

[jplumsdaine22]

Glad you were able to figure out the time range in the search, but I fear you may be missing what is happening here. Read this first:
http://docs.splunk.com/Documentation/Splunk/6.3.2/Indexer/Howindexingworks

[woodcock · Accepted solution]

The ignoreolderthan setting is on forwarding, not on searching. Once the event is in, it is in until it FIFOs out.

[_dave_b]

By adding earliest=-48h to the search criteria, we were able to exclude the old entries, thus solving the issue.

But I would still really like to know the "proper" way to edit the inputs.config file to avoid this issue in the future, and to increase flexibility.

[jplumsdaine22]

I downvoted this post because op missed the point of why the event continued to show up in their search results