timeframe for monitoring old files

[a212830]

Hi,

Will the UF ignore files that are older than a certain value? I am testing against some old files (january), and it doesn't appear to be picking them up.

[bmacias84 · Accepted solution]

This depends on how you defined your monitor stanza in your inputs.conf. By default ignoreOlderThan settings is disabled and recurisve settings is true

If your stanza is defined like such it will pick up all file in directory and sub-directories

[monitor:///var/log]

If youwant to limit which log files to be monitored:

[monitor:///var/log]

ignoreOlderThan=3d

recurisve=false

Also use the btool to determine which settings are being applied by which apps or TAs.

i.e. ./splunk btool --debug inputs list

Additional Reading:

Inputsconf