Is it possible to get data for last 10 days if i install UF today on any endpoint/Server?

[rupeshn]

Is it possible to get data for last 10 days if i install UF today on any endpoint/Server?

I would like to get data like resource utilization of a particular server/endpoint for last 10 days, I'm planning to install Splunk UF today. Can i get the data if i install UF today

[gcusello]

Hi @rupeshn,
with Universal Forwarder, you can set the time limit of your ingestion with the parameter ignoreOlderThan = 10d in inputs.conf of your Universal forwarders, as you can see at https://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf .

Ciao.
Giuseppe