Getting Data In

how to setup forwarder to ingest logs from a specific date / last day's log and carry on monitoring the future files as they are created?

Path Finder

i am dealing with a imilar issue, i am trying to ingest webserver logs and the historical log data in webserver is huge and brought splunk down when i tried to ingest. i want splunk UF to start from the latest or the day before's log file and ingest the new log files that are created in future

exclude logs till march 27th.
ingest march 28th.log
march 29th.log
march 30th.log
march 31th.log
april 1st.log

and all log files post march 28th ( normal splunk UF behaviour)

can i use current_only=1 setting or any other suggested recommendation.

Hope i was clear enough. Thanks in advance

0 Karma


You can set ignoreOlderThan=3d in inputs.conf to do just that, ignore files older than three days or whatever time span you like.

Ultra Champion

Just came across the ignoreOlderThan topic at

0 Karma
Get Updates on the Splunk Community!

.conf23 Registration is Now Open!

Time to toss the .conf-etti 🎉 —  .conf23 registration is open!   Join us in Las Vegas July 17-20 for ...

Don't wait! Accept the Mission Possible: Splunk Adoption Challenge Now and Win ...

Attention everyone! We have exciting news to share! We are recruiting new members for the Mission Possible: ...

Unify Your SecOps with Splunk Mission Control

In today’s post, I'm excited to share some recent Splunk Mission Control innovations. With Splunk Mission ...