ignoreOlderThan in inputs.conf

[siva_cg]

Hi All,

We have Splunk environment with nearly 1000 Universal Forwarders sending logs to Indexers. These Universal Forwarders are managed by Deployment Server.

Now the issue is few of the logs from a folder are missing on Indexers. By running the btool and troubleshooting commands, we came to know that the file is being ignored with the below error:

type = ignored (modtime fell behind window of 604800 seconds ago)

But the files are modified and updated even today. So could you please help us what could be the issue and how to resolve this? The inputs stanza configured is as below:

[monitor:///myfolder/]
whitelist = (a|b|c).log
index = myindex
sourcetype = mysourcetype
ignoreOlderThan = 7d
recursive = true

Thanks in advance.

[somesoni2]

When a monitoring is setup with ignoreOlderThan attribute, it'll exclude all the files which were last modified earlier than the set value. Those excluded files are not included back automatically when they are actually updated. To have Splunk re-evaluate the monitoring file list, you need to get the Splunk (forwarder) instance restarted. If you've a script/utility using which you can re-start all forwarders, do that. Otherwise, you can make some changes to existing app or create a new dummy apps and assign to all fwd with restartSplunkd=true.

[ddsnatalia]

Hi @somesoni2 ,

I have a very similar issue, but we use heavy forwarder and there are thousands of files that have already been indexed (<7days old) and are stored in the same directory; if I change the ignoreOlderThan attribute to say 90 days, will already processed files be re-indexed again?

Thank you,

Nat

[siva_cg]

Thank you very much @somesoni2. This clearly explains why logs are not being monitored. We will restart the UF as suggested.