Reporting

ignoreOlderThan=7d

pacifikn
Communicator

Greetings!!!

What does this mean?

ignoreOlderThan=7d

Tags (1)
0 Karma
1 Solution

vnravikumar
Champion

Hi

Causes the input to stop checking files for updates if the file modification time (modtime) has passed the threshold. This improves the speed of file tracking operations when monitoring directory hierarchies with large numbers of historical files (for example, when active log files share a directory with old files that no longer get writes).
Splunk Enterprise does not index files whose modification time falls outside when it first attempts to monitor the file.

You must specify . For example, "7d" indicates one week. Valid units are "d" (days), "h" (hours), "m" (minutes), and "s" (seconds).

For more info check this: https://docs.splunk.com/Documentation/Splunk/8.0.1/Data/Monitorfilesanddirectorieswithinputs.conf

View solution in original post

0 Karma

vnravikumar
Champion

Hi

Causes the input to stop checking files for updates if the file modification time (modtime) has passed the threshold. This improves the speed of file tracking operations when monitoring directory hierarchies with large numbers of historical files (for example, when active log files share a directory with old files that no longer get writes).
Splunk Enterprise does not index files whose modification time falls outside when it first attempts to monitor the file.

You must specify . For example, "7d" indicates one week. Valid units are "d" (days), "h" (hours), "m" (minutes), and "s" (seconds).

For more info check this: https://docs.splunk.com/Documentation/Splunk/8.0.1/Data/Monitorfilesanddirectorieswithinputs.conf

0 Karma

gjanders
SplunkTrust
SplunkTrust

Keep in mind:

  • once ignored the file will never be looked at again by the forwarder (even if updated) unless the forwarder is restarted
  • Restarting the forwarder resets the ignoreOlderThan list so it only ignores older than 7d in your example (so if you have file server.log, it stops getting updated for 7 days, and then its updated, nothing gets indexed until next restart of the forwarder...)
0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...