Hi
Causes the input to stop checking files for updates if the file modification time (modtime) has passed the threshold. This improves the speed of file tracking operations when monitoring directory hierarchies with large numbers of historical files (for example, when active log files share a directory with old files that no longer get writes).
Splunk Enterprise does not index files whose modification time falls outside when it first attempts to monitor the file.
You must specify . For example, "7d" indicates one week. Valid units are "d" (days), "h" (hours), "m" (minutes), and "s" (seconds).
For more info check this: https://docs.splunk.com/Documentation/Splunk/8.0.1/Data/Monitorfilesanddirectorieswithinputs.conf
Hi
Causes the input to stop checking files for updates if the file modification time (modtime) has passed the threshold. This improves the speed of file tracking operations when monitoring directory hierarchies with large numbers of historical files (for example, when active log files share a directory with old files that no longer get writes).
Splunk Enterprise does not index files whose modification time falls outside when it first attempts to monitor the file.
You must specify . For example, "7d" indicates one week. Valid units are "d" (days), "h" (hours), "m" (minutes), and "s" (seconds).
For more info check this: https://docs.splunk.com/Documentation/Splunk/8.0.1/Data/Monitorfilesanddirectorieswithinputs.conf
Keep in mind: