ignoreOlderThan=7d

[pacifikn]

Greetings!!!

What does this mean?

ignoreOlderThan=7d

[vnravikumar · Accepted solution]

Hi

Causes the input to stop checking files for updates if the file modification time (modtime) has passed the threshold. This improves the speed of file tracking operations when monitoring directory hierarchies with large numbers of historical files (for example, when active log files share a directory with old files that no longer get writes).
Splunk Enterprise does not index files whose modification time falls outside when it first attempts to monitor the file.

You must specify . For example, "7d" indicates one week. Valid units are "d" (days), "h" (hours), "m" (minutes), and "s" (seconds).

For more info check this: https://docs.splunk.com/Documentation/Splunk/8.0.1/Data/Monitorfilesanddirectorieswithinputs.conf

[gjanders]

Keep in mind:

• once ignored the file will never be looked at again by the forwarder (even if updated) unless the forwarder is restarted
• Restarting the forwarder resets the ignoreOlderThan list so it only ignores older than 7d in your example (so if you have file server.log, it stops getting updated for 7 days, and then its updated, nothing gets indexed until next restart of the forwarder...)